AD FS 2.0 integration

Process overview

• Add a relying party (RP) trust to AD FS.
• Add the claims rules.
• Map LDAP attributes to the outgoing claims rules.

Prerequisites

• A metadata XML file provided by Condeco (see ‘Before you start’ for more information about the metadata file).

Add a relying party trust to AD FS

A relying party (RP) trust is a trust object created to maintain the relationship with a Federation Service or application that consumes claims from the Federation Service.

To add a new relying party trust, use the AD FS Management snap-in and manually configure the settings. Follow the steps below on the federation server.

1. Launch AD FS 2.0 Management from the federation server.

2. Navigate to Trust Relationships > Relying Party Trusts.
   

3. Right-click Relying Party Trusts (or click Action from the menu bar) and select Add Relying Party Trust… to start the wizard.
   

4. When the Add Relying Party Trust Wizard opens, click Start.
   

5. Select Import data about the relying party from a file and enter the path to the metadata provided by Condeco. Click Next.

6. Enter a name for the relying party trust (for example, “Condeco SSO”) in the Display name field and click Next.

7. Select I do not want to configure multi-factor authentication settings for the relying party trust at this time and click Next.

8. Select Permit all users to access this relying party on the Choose Issuance Authorization Rules page and click Next.
   

9. The relying party trust is now configured. Click Next to launch the Claim rules.
   

Adding claim rules

The primary function of the Federation Service in AD FS is to issue a token containing a set of claims. Claims rules govern the decision in regard of claims that AD FS issues. Claim rules and all server configuration data are stored in the AD FS configuration database.

10. From the Edit Claims Rules for …. Relying Party window, click Add Rule..
    

11. Select Rule Template: Select Send LDAP Attributes as Claims from the Claim rule template drop-down list.
    

12. Configure Rule: Enter a name for the claim rule in the Claim rule name field and select Active Directory from the Attribute store drop-down list. Now you can map LDAP attributes to outgoing claim types.

Map LDAP attributes to outgoing claim types

13. Map the following LDAP attributes to the outgoing claim types:

LDAP Attribute	Outgoing Claim Type	More information
Display-name	Name
E-Mail-Addresses	E-Mail Address
SAM-Account-Name	Name ID	Condeco recommend using SAM-Account-Name for consistency.
Given-Name	Given Name
Surname	Surname

14. When all required claims are mapped, click OK to close the wizard.