Configuring ADFS 3.0 to Communicate with WhosOnLocation SAML

Transcription

1 Configuring ADFS 3.0 to Communicate with WhosOnLocation SAML Contents Overview... 2 General ADFS Setup... 2 WhosOnLocation Settings... 4 ADFS Relying Party Configuration... 5 ADFS Relying Party Claim Rules... 6 Logging into ADFS P age

2 Overview SAML 2.0 single sign-on (SSO) supports integration with Microsoft Active Directory Federation Services (ADFS) 3.0. General ADFS Setup This procedure uses ADFS 3.0 and shows samlportal.example.com as the ADFS website. Replace this with your ADFS website address. 1. Log into the ADFS server and open the management console. 2. Right-click Service and choose Edit Federation Service Properties... Figure 1 - Editing federation services properties 3. Confirm that the General settings match your DNS entries and certificate names. Take note of the Federation Service Identifier, since that is used in the WhosOnLocation SAML configuration settings. 2 P age

3 Figure 2 - Federation Service Identifier 4. Browse to the certificates and export the Token-Signing certificate. a) Right-click the certificate and select View Certificate. b) Select the Details tab. c) Click Copy to File. The Certificate Export Wizard launches. d) Select Next. e) Ensure No, do not export the private key is selected, and then click Next. 3 P age

4 f) Select DER encoded binary X.509 (.cer), and then click Next. g) Select where you want to save the file and give it a name. Click Next. h) Select Finish. WhosOnLocation requires that this certificate be in PEM format. You can convert this certificate using client tools or even online tools such as: SSL Shopper. Use the DER/Binary certificate we just created and export it to Standard PEM format. WhosOnLocation Settings With your SAML server configured and the information you need for setting up SAML in WhosOnLocation at hand, log in to your WhosOnLocation as an administrator and follow this procedure. Figure 3 - WhosOnLocation SAML configuration To enable SAML in your WhosOnLocation fill out the following options on your WhosOnLocation security page. 4 P age

5 Issuer URL This is the Federation Service Identifier from ADFS SSO Endpoint This is the URL that WhosOnLocation will invoke to redirect users to your Identity Provider. SLS Endpoint This is the URL that WhosOnLocation will return your users to after they log out. Certificate Paste your PEM certificate from the previous section Select Save SAML Configuration and then click the Download Metadata button at the bottom of the screen, this will provide you with a metadata file for the next section. Under the Our Parameters section you will find all the URL values that need to be entered in to ADFS, copy or make a note of these. Figure 4 - WhosOnLocation SAML settings ADFS Relying Party Configuration At this point you can take the WhosOnLocation Metadata and import it into your ADFS server. However, manual configuration of the relying party appears to be easier to implement. 5 P age

6 1. Open the ADFS Management console and select Relying Party Trusts. 2. Select Add Relying Party Trust from the top right corner of the window. 3. Click Start to begin. 4. Use the Import File option to import the metadata file. 5. Give it a display name such as WhosOnLocation and enter any notes you want. 6. Select ADFS 3.0 Profile. 7. Do not select a token encryption certificate. It will use the certificate that is defined on the service that has already been exported. Defining a certificate here will prevent proper communication with WhosOnLocation. 8. Do not enable any settings on the Configure URL. 9. Enter the entityid as shown on the WhosOnLocation SAML screen as the Relying Party trust identifier (e.g. and click Add. 10. Permit all users to access this relying party. 11. Click Next and clear the Open the Claims when this finishes check box. 12. Close this page. The new relying party trust appears in the window. 13. Right-click on the relying party trust and select Properties. 14. Browse to the Advanced tab and set the Secure hash algorithm to SHA Browse to the Endpoints tab and add a SAML Assertion Consumer with a Post binding and the Consumer URL as shown on the WhosOnLocation SAML screen (e.g. ADFS Relying Party Claim Rules Edit the Claim rules to enable proper communication with WhosOnLocation. 1. Right-click on the relying party trust and select Edit Claim Rules. 2. On the Issuance Transform Rules tab select Add Rules. 6 P age

7 3. Select Send LDAP Attribute as Claims as the claim rule template to use. 4. Give the claim a name such as Get LDAP Attributes. 5. Set the Attribute Store to Active Directory, the LDAP Attribute to -Addresses, and the Outgoing Claim Type to Address. Figure 5 - Editing a rule 6. Select Finish. 7. Select Add Rule. 8. Select Transform an Incoming Claim as the claim rule template to use. 9. Give it a name such as to Name ID. Incoming claim type should be Address (it must match the Outgoing Claim Type in rule #1. The Outgoing claim type is Name ID (this is requested in 7 P age

8 WhosOnLocation policy urn:oasis:names:tc:saml:1.1:nameid-format: address) and the Outgoing name ID format is . Pass through all claim values and click Finish. Figure 6 - Editing a rule Logging into ADFS 1. Browse to your ADFS sign-on page (e.g. This opens a generic page with a drop down list of all Relying Party Trusts configured. 2. Select the one you want to log in to and click on Continue to Sign In. If WhosOnLocation SAML is configured properly you will be logged in to the application, any errors will be displayed on the screen and the standard login form shown. 8 P age