Active Directory Federation Services

Introduction

Active Directory Federation Services (ADFS) is the single sign-on (SSO) solution. It facilitates access to all integrated applications and systems with just your Active Directory (AD) credentials.

Install the ADFS role

To install the ADFS role:

Open Server Manager>Manage>Add roles and features. The Add Roles and Features wizard is launched.
On the Before you begin page, click Next.
On the Select installation type page, select Role-based or Feature-based installation and then click Next.
On the Select destination server page, click Select a server from the server pool and click Next.
On the Select server roles page, select Active Directory Federation Services and click Next.
On the confirmation page, click Install. The wizard displays the installation progress.
Verify the installed component and click Close.

Configure the federation server

To configure the federation server:

On the Server Manager Dashboard, click the Notifications flag and then click Configure the federation service on the server. The Active Directory Federation Service Configuration Wizard is launched.
On the Welcome page, select Create the first federation server in a federation server farm and click Next.
On the Connect to Active Directory Domain Services page, specify an account with domain administrator rights for the Active Directory domain that this system is connected to and then click Next.
On the Specify Service Properties page, enter the following details before clicking Next:
1. Browse to the location of the SSL certificate and import it.
2. Enter a Federation Service Name. This is the same value provided when you enrolled an SSL certificate in Active Directory Certificate Services (AD CS).
3. Enter a Federation Service Display Name.
On the Specify Service Account page, select Use an existing domain user account and click Next.
On the Specify Configuration Database page, select Create a database on this server using Windows Internal Database and click Next.
On the Pre-requisite Checks page, verify that all prerequisite checks were successfully completed and click Configure.
Review the results and check whether the configuration has been completed successfully on the Results page.

Create a relying party

To create a relying party:

On the Start menu, click Administrative Tools > AD FS Management. The ADFS Management console is launched.
Click Relying Party Trusts. The wizard to add a relying party is launched.
On the Add Relying Party Trusts Wizard, select Claims Aware and then click Start.
Under Select Data Source, select Enter data about the relying party manually.
In Specify Display Name field, enter MangoApps Cloud Platform.
In the Configure URL section, select Enable Support for SAML 2.0 WebSSO Protocol and enter Relying party service URL as https://adfs.xxxx.com/adfs/ (example).
On the Configure Identifiers page, enter Relying Party Trust Identifier and click Add.
Under Choose Access Control Policy, select Permit everyone and click Next.
On the Finish page, select Configure claims issuance policy for this application and click Close. The Claim Issuance policy page is launched.
If the Claim Issuance Policy page does not open, open AD FS Management Snap and right-click Relying on party trust > select Edit Claim Issuance Policy.

Create a new claim

Right-click MangoApps Cloud under Relying Party Trusts list and select Edit Claim Issuance Policy from the menu.
On the Issuance Transform Rules tab, click Add Rule.
Under Select Rule Template, set Send LDAP attributes as Claims as the rule template and click Next.
In the Edit Rule section, set the claim rule name as LDAP Directory.
Enter the appropriate values in each field based on the descriptions provided below.

Field

Action

Claim rule name

Enter a name for the claim rule.

Attribute store

Select Active Directory from the list.

Mapping of LDAP attributes to outgoing claim types

LDAP Attribute

Enter the outgoing claim type.

E-mail Addresses

Enter the Name ID.

E-mail Addresses

Enter the e-mail address.

User-Principal-Name

Enter the user name.

Click OK.

Create a custom rule

On the Edit Claim Issuance Policy window, under the Issuance Transform Rules tab, click Add Rule. The Select Rule Template page is displayed.
From the Claim rule template list, select Transform an Incoming Claim and click Next. The Edit Rule – LDAP EMAIL window is displayed.
Enter appropriate values based on the actions suggested for each field.
Click Finish.

Configure the Single Sign-On settings

To configure the single sign-on settings login to MangoApps admin console.

On the MangoAppsCloud Platform console, go to Settings.
Open the Single Sign-On tab and click Edit.
Enter appropriate attribute values based on the descriptions provided below for each field.
Click Save. After this configuration, SSO can be enabled for administrators and users.

Enable SSO for Administrators

On the MnagoApps Cloud Platform console, got to Settings.
On the Single Sign-On settings, click Edit. The Single Sign-On Settings page is displayed.
Select Enable single sign-on for administrators.
Click Save.

FAQs

What is the federation metadata address (hostname or URL) for Mango Apps?

Ans: We do not have federation metadata published, you need to create a Relying Party Trust in your ADFS server and then put the metadata of your ADFS server in MA.

MA will read that metadata and configure it.