Active Directory Federation Services
Last updated
Last updated
Active Directory Federation Services (ADFS) is the single sign-on (SSO) solution. It facilitates access to all integrated applications and systems with just your Active Directory (AD) credentials.
To install the ADFS role:
Open Server Manager>Manage>Add roles and features. The Add Roles and Features wizard is launched.
On the Before you begin page, click Next.
On the Select installation type page, select Role-based or Feature-based installation and then click Next.
On the Select destination server page, click Select a server from the server pool and click Next.
On the Select server roles page, select Active Directory Federation Services and click Next.
On the confirmation page, click Install. The wizard displays the installation progress.
Verify the installed component and click Close.
To configure the federation server:
On the Server Manager Dashboard, click the Notifications flag and then click Configure the federation service on the server. The Active Directory Federation Service Configuration Wizard is launched.
On the Welcome page, select Create the first federation server in a federation server farm and click Next.
On the Connect to Active Directory Domain Services page, specify an account with domain administrator rights for the Active Directory domain that this system is connected to and then click Next.
On the Specify Service Properties page, enter the following details before clicking Next:
Browse to the location of the SSL certificate and import it.
Enter a Federation Service Name. This is the same value provided when you enrolled an SSL certificate in Active Directory Certificate Services (AD CS).
Enter a Federation Service Display Name.
On the Specify Service Account page, select Use an existing domain user account and click Next.
On the Specify Configuration Database page, select Create a database on this server using Windows Internal Database and click Next.
On the Pre-requisite Checks page, verify that all prerequisite checks were successfully completed and click Configure.
Review the results and check whether the configuration has been completed successfully on the Results page.
To create a relying party:
On the Start menu, click Administrative Tools > AD FS Management. The ADFS Management console is launched.
Click Relying Party Trusts. The wizard to add a relying party is launched.
On the Add Relying Party Trusts Wizard, select Claims Aware and then click Start.
Under Select Data Source, select Enter data about the relying party manually.
In Specify Display Name field, enter MangoApps Cloud Platform.
In the Configure URL section, select Enable Support for SAML 2.0 WebSSO Protocol and enter Relying party service URL as https://adfs.xxxx.com/adfs/ (example).
On the Configure Identifiers page, enter Relying Party Trust Identifier and click Add.
Under Choose Access Control Policy, select Permit everyone and click Next.
On the Finish page, select Configure claims issuance policy for this application and click Close. The Claim Issuance policy page is launched.
If the Claim Issuance Policy page does not open, open AD FS Management Snap and right-click Relying on party trust > select Edit Claim Issuance Policy.
Right-click MangoApps Cloud under Relying Party Trusts list and select Edit Claim Issuance Policy from the menu.
On the Issuance Transform Rules tab, click Add Rule.
Under Select Rule Template, set Send LDAP attributes as Claims as the rule template and click Next.
In the Edit Rule section, set the claim rule name as LDAP Directory.
Enter the appropriate values in each field based on the descriptions provided below.
Field
Action
Claim rule name
Enter a name for the claim rule.
Attribute store
Select Active Directory from the list.
Mapping of LDAP attributes to outgoing claim types
LDAP Attribute
Enter the outgoing claim type.
E-mail Addresses
Enter the Name ID.
E-mail Addresses
Enter the e-mail address.
User-Principal-Name
Enter the user name.
Click OK.
On the Edit Claim Issuance Policy window, under the Issuance Transform Rules tab, click Add Rule. The Select Rule Template page is displayed.
From the Claim rule template list, select Transform an Incoming Claim and click Next. The Edit Rule – LDAP EMAIL window is displayed.
Enter appropriate values based on the actions suggested for each field.
Click Finish.
To configure the single sign-on settings login to MangoApps admin console.
On the MangoAppsCloud Platform console, go to Settings.
Open the Single Sign-On tab and click Edit.
Enter appropriate attribute values based on the descriptions provided below for each field.
Click Save. After this configuration, SSO can be enabled for administrators and users.
On the MnagoApps Cloud Platform console, got to Settings.
On the Single Sign-On settings, click Edit. The Single Sign-On Settings page is displayed.
Select Enable single sign-on for administrators.
Click Save.
Ans: We do not have federation metadata published, you need to create a Relying Party Trust in your ADFS server and then put the metadata of your ADFS server in MA.
MA will read that metadata and configure it.
Ans: It should be "https://<yourdomain>.mangoapps.com/saml/consume".
Ans: It should be "https://<yourdomain>.mangoapps.com/saml/consume" and binding should be "POST".
Ans: You need to use LDAP Attribute "E-Mail Address" as "NameID" as the Outgoing claim type by transforming the incoming claim.
