---
title: "EasySSO SAML with ADFS"
canonical: "https://www.techtime-initiative.com/space/EasySSO/5308548/EasySSO%20SAML%20with%20ADFS"
format: markdown
---
Step-by-Step Instructions to configure EasySSO SAML with Active Directory Federation Service (ADFS) as an Identity Provider

> Macro (toc)

## Configure the EasySSO Side

Open EasySSO and select SAML. On the SAML configuration screen make sure “Enable SAML” is ticked

![image-20240829-022444.png](media://646d5ab9-b90d-40f8-8ee2-d0410f2d8fa0)

Click the `Certificates` tab. Add the IdP Metadata URL for the ADFS server. The standard is to have the URL end with /federationmetadata/2007-06/federationmetadata.xml. Click `Load Certificate`.

![image-20240829-022457.png](media://323406bb-2d9e-413a-825f-c3b1c51f8fbd)

On the **Certificates** page, generate the SP Signing certificate. Click `Save`:

![image-20240829-022806.png](media://b95fab05-7b91-4658-aaad-65d68d24e62e)

On the **General** page:

1. Set the **Login Binding Type** to "POST"
2. Set the **POST Binding URL** to the ADFS endpoint https://<yourADFSServer>/adfs/ls/
3. Make sure **Sign SP Login Request** is ticked

![image-20240829-023014.png](media://ec4b6b4e-c048-44e8-a4e3-8d3b0b5c913a)

On the **General** page:

1. Set** Logout Binding Type** to "POST"
2. Enable **Sign SP Logout request**
3. Enable **Sign SP Logout response**
4. Enable **Verify Logout Request Signature**
5. Enable **Verify Logout Response Signature**

![image-20240829-023111.png](media://e79ac32b-a492-4369-8829-644346c1d0c4)

On the **General** page:

1. Configure settings for "New Users", first time login from SAML provider
2. Configure settings for "Existing Users" which have previously logged in
3. Configure default groups to ensure that logged in users are provisioned with the correct groups and permissions
4. Save settings

![image-20240829-023217.png](media://9590602b-cc05-4f5f-b2c0-742e793d6025)

## Export metadata.xml

On the **General** page, Save the **metadata.xml** file to use later. The URL can also be used directly if your network is configured to allow it.

![EasySSO SAML-Signed Requests-7.png](media://b56dd9cd-31ac-4c72-b259-fafddb125599)

## Configure the ADFS Side

### Create the Relying Party Trust

Right click on **Relying Party Trusts**, Click **Add Relying Party Trust...**

![image-20240829-023610.png](media://b3ad10c7-f42c-4b54-add6-b789452539bd)

On the trust party wizard **Welcome** page, click **Start** to continue to the **Select Data Source** page.

- **Either** Select “Import data about the relying party from a file“ and Import the previously created **metadata.xml** file.
- **Or** if the URL of the SAML metadata endpoint is accessible from your machine, Select “Import data about the relying party published online or on a local network” and paste your metadata URL

Then click `Next`

![image-20240829-023728.png](media://56c0f445-64e3-40fb-b834-dbb04b2632c6)

On the **Specify Display Name** page, Set **Display Name.** For example "EasySSO for Jira". Click `Next`.

![image-20240829-024323.png](media://6d233954-1a8a-47c9-acab-4e9e75c72904)

On the **Configure Multi-factor Authentication Now**? page, Make sure **'I do not want to configure multi-factor authentication settings for this relying party trust at this time'** is selected. Click `Next`.

![image-20240829-024440.png](media://0ad00cba-ce1e-4c8e-a04a-caf761459461)

On the **Choose Issuance Authorization Rules** page, Make sure **'Permit all users to access this relying party'** is selected, and click `Next`.

![image-20240829-024626.png](media://8764c26a-4406-465f-a044-354468af8fe0)

On the **Ready to Add Trust**, Click **Next** to continue to the **Finish** step. Make sure **Open the Edit Claim Rules dialog for this relying party trust when the wizard closes** is not checked, then Click **Close**. 

Right click the Relying Party Trust just created, Select **Properties**, go to the **Advanced tab**, and set the **secure hash algorithm** to SHA-1.

![image-20240829-025943.png](media://4850a477-ed34-4bc0-ae3e-e9d67f73194f)

### Create the Claim Issuance Policy

Right click the Relying Party Trust just created, and Click **Edit Claim Issuance Policy**. On the **Issuance Transform Rules** tab, click `Add Rule`.

![image-20240829-030718.png](media://87d1e2b6-6311-48ac-a0a7-ffc4c6e0331b)

On the **Choose Rule Type** step, select **Send LDAP Attributes as Claims. **Click **Next**.

![image-20240829-030809.png](media://ef559edf-89be-4364-92fa-d5fdb25d29bc)

On the **Configure Claim Rule** step:

1. Set **Claim Rule Name** to 'EasySSO <Platform> Claims'
2. Set **Attribute Store** to **Active Directory**
3. Set **Mapping of LDAP attributes to outgoing claim types**
  1. Display-Name → urn:oid:2.16.840.1.113730.3.1.241
  2. E-Mail-Addresses → urn:oid:0.9.2342.19200300.100.1.3
  3. User-Principal-Name  → urn:oid:0.9.2342.19200300.100.1.1
  4. User-Principal-Name  → Name ID
4. Click Finish

![image-20240829-033109.png](media://7d814b91-d034-4831-a50c-a0599d76d223)

### Add session information transformation

On the same **Issuance Transform Rules** tab, click `Add Rule`. On the **Choose Rule Type** step, select **Transform an Incoming Claim. **Click **Next**.

![image-20240829-033540.png](media://1e9a3ba4-6115-444d-a058-000afa48bf16)

On the **Configure Claim Rule** step:

1. Set **Claim Rule Name** to "EasySSO Session information" or something similar
2. Set **Incoming claim type** to **UPN**
3. Set **Outgoing claim type** to **Name ID**
4. Set **Outgoing name ID format** to **UPN**
5. Select **pass through all claim values**
6. Click Finish

![image-20240829-033659.png](media://4a745126-3ab5-43f0-8c93-df115acb1bd9)

## Encrypted Assertions

### EasySSO side

1. Open the EasySSO Admin page
2. Click the SAML button to be taken to the SAML Admin configuration
3. Check the 'Encrypt Assertions' check box
4. Click the Save button at the bottom of the page to save the updated configuration
5. Click the 'Certificates' tab
6. Click the button to download the SP Certificate. This certificate is in a CER format

### ADFS server side

1. Open your SAML Administration page
2. Open the SAML Client configuration
3. Upload the SP Certificate previously downloaded into the encrypted certificate section.

![ADFS_EncryptedAssertionCertificate.png](media://c6d1f4fd-9dab-4d7f-94c1-77d030e73eee)

If you enable Encrypted Assertions the following PowerShell script will need to be run on the ADFS Server. Once the script has been run, select the relying party trust to prevent checking the encryption certificate revocation list(CRL). The certificate only exists on your EasySSO server.

```
Get-ADFSRelyingPartyTrust | Select-Object name,Identifier |
Out-GridView -Title "Select a relying party" -PassThru |
%{ Set-AdfsRelyingPartyTrust -TargetIdentifier ([string] $_.Identifier) -SigningCertificateRevocationCheck None -EncryptionCertificateRevocationCheck None }
```

## Configuring Users

For users to successfully log in, they must also have permission to access the application. See [EasySSO SAML JIT User Provisioning](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/5046870) for more details.


> ℹ️ For more customisation options, check out [EasySSO with SAML - Configuration](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/4948647).