SAML Configuration for Microsoft AD FS

LAST UPDATED: DEC 02, 2024

Overview

This guide provides step-by-step instructions for configuring SAML authentication between Microsoft Active Directory Federation Services (AD FS) and D3 vSOC. It includes setting up the SAML app in Microsoft AD FS, creating and assigning users, and enabling login via Microsoft AD FS to D3 vSOC.

Prerequisites

To enable single sign-on (SSO) through AD FS, follow these steps:

• If SSO is not already enabled on AD, refer to the Troubleshooting Active Directory Federation Services Idp-initiated sign-on documentation.

• For creating a new user account in Active Directory, refer to the guide on Creating a New Active Directory User Account. The username preceding the domain name must match the D3 vSOC username.

Procedure

Configuring SAML in Microsoft AD FS

1. Navigate to the Control Panel within the AD server, then click on the System and Security category.

   

2. Click on the Administrative Tools sub-category.

   

3. Double-click AD FS Management. If it is not visible, refer to the Prerequisites section to ensure the AD FS service is installed correctly.

   

4. Click on the Action menu, then click on the Add Relying Party Trust menu option.

   

5. Ensure that the Claims aware radio option is selected, then click on the Start button.

   

6. Select the Enter data about the relying party manually radio option, then click on the Next button.

   

7. Input an appropriate name for the SAML application.

   

8. Click on the Next button.

   

9. Select the checkbox labeled Enable support for the SAML 2.0 WebSSO protocol, enter the D3 login URL in the Relying party SAML 2.0 SSO service URL field (ensuring it includes Login.aspx), then click the Next button.

   

10. Enter the D3 vSOC login URL into the Relying party trust identifier field (excluding Login.aspx), then click the Add button.

    

11. Click on the Next button.

    

12. Click on an access control policy in the Access Control Policy setting to restrict access, then click on the Next button. By default, access is permitted for everyone.

    

13. Click on the Next button.

    

14. Click on the Close button to finish, and render a Edit Claim Issuance Policy for <SAML Application Display Name> popup.

    

Alternate Method to Access the Edit Claim Issuance Policy for <SAML Application Display Name> Popup

The Edit Claim Issuance Policy for <SAML Application Display Name> popup can also be accessed through the Relying Party Trusts folder.

1. Click on the Relying Party Trusts folder.

2. Select the application for which the claim issuance policy needs to be edited.

3. Click on the Edit Claim Issuance Policy option on the right.

15. Click on the Add Rule button within the Edit Claim Issuance Policy for <SAML Application Display Name> popup.

    

16. Select Send LDAP Attributes as Claims for the Claim rule template, then click on the Next button.

    

17. Enter a claim rule name, select the Active Directory attribute store, then select User-Principal-Name LDAP attribute and the Name ID outgoing claim type.

    

18. Click on the Finish button.

    

19. Click on the OK button to close the pop up window.

    

20. View the certificate.

    

    1. Click on the Service folder under AD FS.

    2. Click on the Certificates folder.

    3. Right click on the certificate under the Token-signing section.

    4. Click on the View Certificate option within the popup.

21. Click on the Details tab.

    

22. Click on the Copy to File button.

    

23. Click on the Next button.

    

24. Select the Base-64 encoded X.509 (.CER) radio option, then click on the Next button.

    

25. Select a file path to export the certificate, then click on the Next button.

    

26. Click on the Finish button.

    

27. Open the certificate at the saved path.

    

READER NOTE

Before proceeding, ensure that you have:

• Created D3 user accounts (Organization Management > Users > + Add Users)

• Reviewed the procedure for adding a new login method. Your new Microsoft AD FS SAML login method must to be assigned to the appropriate D3 user accounts (Application Settings > Login Authentication > Users) after step 28 below.

28. Input the Certificate into D3 vSOC.

    

29. Input the Target URL into D3 vSOC. It is a URL in the following format:
    https://<domain>/adfs/ls/idpinitiatedsignon.aspx

    

30. Input the Assertion Consumer Service URL into D3 vSOC. This is the D3 login URL in the format: https://<domain>/<path>/VSOC/Login.aspx

    

Login to D3 vSOC via Microsoft AD FS

1. Navigate to https://<domain>/adfs/ls/idpinitiatedsignon.aspx.

2. Sign in.

   

After successfully logging in to Microsoft AD FS, the user will be redirected to D3 vSOC.