How to setup SSO with ADFS

About this article

This article describes how an organization can set up SSO on ADFS utilizing the SAML2 protocol by adding a new relying party trust to the Federation Service.

• Manual Setup
• Using Powershell
• Templafy Metadata
• ADFS Claim Setup
• ADFS Example Settings - Windows Server 2012 R2
• Error: "401: Server Error" or Login Screen Popup

 

Prerequisites

Membership in Administrators, or equivalent, is the minimum required to complete this procedure

 

Manual Setup

If you wish to create the Relying party by using the ADFS Management to manually configure the settings, perform the following procedure on a federation server. Utilize the Templafy metadata in the table below.

Reference: Create a Relying Party Trust | Microsoft Learn

 

Using Powershell

The Add-AdfsRelyingPartyTrust cmdlet adds a new relying party trust to the Federation Service. You can specify a relying party trust manually, or you can provide a federation metadata document to bootstrap initial configuration. Templafy metadata can be found below.

 Add-ADFSRelyingPartyTrust -Name "Templafy" -MetadataURL "Paste Metadata URL from the below table"

 

Templafy Metadata

Metadata URL	West Europe (Production 0): https://templafyprod0.auth.templafy.com/auth/saml2/auth-services West Europe (Production 1): https://templafyprod1.auth.templafy.com/auth/saml2/auth-services East US: https://templafyprod2.auth.templafy.com/auth/saml2/auth-services East Australia: https://templafyprod3.auth.templafy.com/auth/saml2/auth-services Canada: https://templafyprod4.auth.templafy.com/auth/saml2/auth-services West Europe (Production 5): https://templafyprod5.auth.templafy.com/auth/saml2/auth-services
Identifier (Entity ID)	https://auth.templafy.com/auth/saml2/auth-services
Reply URL (Assertion Consumption Service)	West Europe (Production 0): https://templafyprod0.auth.templafy.com/auth/saml2/auth-services/Acs West Europe (Production 1): https://templafyprod1.auth.templafy.com/auth/saml2/auth-services/Acs East US: https://templafyprod2.auth.templafy.com/auth/saml2/auth-services/Acs East Australia: https://templafyprod3.auth.templafy.com/auth/saml2/auth-services/Acs Canada: https://templafyprod4.auth.templafy.com/auth/saml2/auth-services/Acs West Europe (Production 5): https://templafyprod5.auth.templafy.com/auth/saml2/auth-services/Acs
Sign on URL	https://CLIENTSUBDOMAIN.hive.templafy.com or https://CLIENTSUBDOMAIN.templafy.com
Hash function to use for digital signing at IdP	SHA-256
User Identifier	mail

 

Once the relying party has been set up, provide the metadata.xml file to your Templafy Implementation Partner.

 

ADFS Claim Setup

The following will send all ADFS-supported claims to Templafy, including all Membership Groups.

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"] => issue(store = "Active Directory", types = (   "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcode", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/country", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone", "http://schemas.templafy.com/2016/06/identity/claims/department", "http://schemas.templafy.com/2016/06/identity/claims/city", "http://schemas.templafy.com/2016/06/identity/claims/jobtitle", "http://schemas.templafy.com/2016/06/identity/claims/facsimilenumber", "http://schemas.templafy.com/2016/06/identity/claims/phonenumber","http://schemas.templafy.com/2016/06/identity/claims/displayname", "http://schemas.microsoft.com/ws/2008/06/identity/claims/role"), query = ";mail,userPrincipalName,mail,givenName,sn,postalCode,st,co,mobile,department,l,title,facsimileTelephoneNumber,telephoneNumber,displayname,tokenGroups ;{0}", param = c.Value);

 

Review the snippet to ensure the claims match the respective attributes in your ADFS

 

Additional custom claims may also be configured within the SAML2 protocol.

Reference: How to setup SSO with Microsoft Entra ID - SAML2

 

ADFS Example Settings - Windows Server 2012 R2

Below are examples of a Windows Server 2012 with Templafy configured as a Relying Party Trust.

• Federation Service properties
  
  

 

• Trust Relationships - Monitoring
  
  

If your ADFS server does not support TLS 1.2, you won't be able to Test the URL.

 

• Trust Relationships - Identifiers
  
  

 

• Trust Relationships - Encryption
  
  

 

• Trust Relationships - Signature
  
  

 

• Trust Relationships - Endpoints
  
  

 

• Trust Relationships - Advanced / Hash algorithm
  
  

 

• Trust Relationships - Claim Rules
  
  

 

• Trust Relationships - Basic Claim Rules (LDAP attribute)
  
  

 

• Trust Relationships - Custom Claim Rules (Custom Rule Language)
  
  

 

• Trust Relationships - Issuance Authorization Rules
  
  

 

Error: "401: Server Error" or Login Screen Popup

If you see one of the below images, the ADFS connection between your organization and Templafy is configured incorrectly.

 

Solution

Add "https://sts.yourdomain.com" as a Trusted Local Intranet site in Internet Options on the local machines that are experiencing the issue.

To add via GPO:

1. Open Group Policy Editor
2. Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page
3. Open Site to zone Assignment List
4. Change the setting to Enabled
5. Click Show
6. Add "https://sts.yourdomain.com" or "https://*.yourdomain.com" and set Value to 1
7. Click OK

 

 

Related articles

Supported Authentication Methods