Configure SAML single sign-on with ADFS

The SAML single sign-on with ADFS allows employees to access and contribute to your platform site without having to register or log in manually to the platform.

Before you start

Before you configure SAML single sign-on with ADFS, there are a few things to know:

You will need the metadata file for your platform site. This can be downloaded from http://example.wazoku.com/saml_ol/metadata.xml where "example" is your domain name.
You will need Active Directory Federation Services (ADFS).
Permission to create a “Relying Party Trust” and "Claim Rule" on ADFS.

1. Create a Relying Party Trust

In Server Manager, click Tools, and then select AD FS Management.
Under Actions, click Add Relying Party Trust.
On the Select Data Source page, select Import data about the relying party from a file.
Click Browse to locate the metadata.xml file you downloaded, then click Next.
On the Choose Issuance Authorization Rules page, select Permit all users to access this relaying party, and then click Next.
Click Finish to create the Relying Party Trust.

Note: If you want to limit access to specific groups of users, select Deny all users access to this relying party and whitelist the users or groups of users that should have access.

Tip: For more information about creating a Relying Party Trust please see Microsoft's documentation on creating a Relying Party Trust.

2. Add a Rule to Send LDAP Attributes as Claims

In Server Manager, click Tools, and then select AD FS Management.
In the console tree, under AD FS, click Claims Provider Trusts.
Right-click the newly created trust, and then click Edit Claim Rules.
In the Edit Claim Rules dialog box, under Acceptance Transform Rules click Add Rule to start the rule wizard.
On the Select Rule Template page, under Claim rule template, select Send LDAP Attributes as Claims from the list, and then click Next.
Configure the new claim rule to map the attributes from “E-Mail-Addresses” to “E-Mail Address”.
Click Finish.
In the Edit Claim Rules dialog box, click OK to save the rule.

Note: You also have the option to add attributes for Given Name or Surname by adding them below “E-Mail-Addresses“ and map them to, respectively, Given Name or Surname claim types.

Tip: For more information about creating a Claim Rule please see Microsoft's documentation on creating a Rule to Send LDAP Attributes as Claims.

3. Add a second Rule: Transforming incoming claims

Right-click the newly created trust again, and then click Edit Claim Rules.
In the Edit Claim Rules dialog box, under Acceptance Transform Rules click Add Rule to start the rule wizard.
On the Select Rule Template page, under Claim rule template, select Transform an Incoming Claim from the list, and then click Next.
On the Configure Rule page, under Claim rule name, type “Convert Email Address to SAML format“.
In Incoming claim type, select E-mail Address.
In Outgoing claim type, select Name ID.
Set the Outgoing name ID format to Email.
Select Pass through all claim values.
Click Finish.
In the Edit Claim Rules dialog box, click OK to save the rule.

Tip: For more information about Transform an Incoming Claim please see Microsoft's documentation on create a Rule to Transform an Incoming Claim.