Active Directory Federation Services (ADFS) is a Windows Server component that allows organizations to use Single Sign-on (SSO) access with other applications. In this guide, we will detail the setup required within ADFS to successfully integrate your SSO with Workplace.
Configure ADFS for SSO with Workplace
In order to configure ADFS for Workplace you need to meet the following prerequisites:
- Your SSO system uses Windows Server version 2019 or 2016, Active Directory Domain Services (ADDS), and Active Directory Federation Services (ADFS) v4 or v5.
- You have been assigned System Admin role in your Workplace instance.
- Your Workplace admin user has the exact same email address as your corresponding Active Directory user. If the email addresses are not a case sensitive match, you will not be able to complete this procedure successfully.
Gather the parameters needed to configure ADFS
Follow the steps below in Workplace to find the parameters you need to configure ADFS.
Create the Relying Party Trust in ADFS
Before ADFS will allow federated authentication (i.e., SSO) for an external system, you must set up a Relying Party Trust. This configuration identifies the external system along with the specific technology that is used for SSO. This procedure will create a Relying Party Trust that produces SAML 2.0 Assertions for Workplace.
DisplayNameas Workplace. Click Next.
RelyingPartyTrust Identifier, click Add and then click Next.
Create the Claim Rules
After a user is authenticated, ADFS claim rules specify the data attributes (and those attributes’ format) that will be sent to Workplace in the SAML Response. Since Workplace requires a Name ID element that contains the user’s email address, this example shows a configuration with two rules:
- The first rule extracts the user’s User Principal Name from Active Directory (i.e., the user’s Windows Account Name);
- The second rule transforms the User Principal Name into a Name ID with Email format.
Prepare to create your claim rules
Setup ADFS to create the two claim rules to configure SSO for Workplace.
Create the first rule
Create the first rule to retrieve email address field from Active Directory when the user is authenticated.
Create the second rule
Create the second rule to map email address field to
Name Id assertion in SAML response.
Gather ADFS parameters needed to configure Workplace
In order to complete the setup we need to retrieve some parameters that have to be configured in Workplace.
entityIDattribute of the
Locationattribute of the the
AssertionConsumerServiceelement that has
Binding typeset to
Convert your certificate into X.509 format
Once you've gone through your identity provider's setup:
Complete Workplace SSO configuration
You will need your SAML URL, SAML Issuer URL and exported certificate file to complete SSO configuration in Workplace. Please follow the guide in the section Configure Workplace for SSO.