Active Directory Federation Services (AD FS)
1 - On the server you intend to use as an IdP:
1.1 - Install the AD FS role service (guide) and enable the Web Server (IIS) role at the same time time
1.2 - In IIS Manager, add an HTTPS binding to your Default Web Site:
Go to Server Certificates and create a self-signed certificate, then export it
Right-click Default Website > Edit Bindings, then add a new HTTPS binding using the above certificate
1.3 - Configure the federation server (guide)
2 - Browse to your Dash Enterprise Server Manager Settings and enable SAML:
2.1 - Select the following options:
Use SAML for authentication
No IdP metadata is available yet
Disable TLS/SSL certificate validation when communicating with the IdP
2.2 - Leave the remaining options as their default values
2.3 - Save the settings and restart when prompted
2.4 - When the app reports ready, return to Settings and copy the SP (local) Metadata URL
Ensure that your IdP can browse to this URL before proceeding
3 - Return to your Active Directory server and:
3.1 - Create a claims-aware relying party trust (guide) using data imported from the SP (local) Metadata URL from the Dash Enterprise Settings
3.2 - Add a claims issuance policy with a rule sending the following LDAP attributes as claims (guide):
SAM-Account-Name attribute mapped to Name ID outgoing claim type
E-Mail-Addresses attribute mapped to EMail Address outgoing claim type
3.3 - Retrieve the Federation Metadata endpoint
You can find this in the AD FS snap-in’s > Service > Endpoints view
Append this value to your IdP’s hostname to get your IdP metadata URL
4 - Return to your Server Manager settings and:
4.1 - In the SAML settings section, select Enter a URL to the IdP (remote) metadata
4.2 - In the IdP (remote) Metadata URL field, enter the Federation Metadata URL endpoint you retrieved above
4.3 - Save the settings and restart when prompted
Last updated