/
Single Sign On (SSO) for ADFS

Single Sign On (SSO) for ADFS

Nov 04, 2020

It is possible to configure ADFS to work with Projector's Single Sign On feature. This page will walk you through a general configuration.

This page assumes that the AD FS 2.0 snap-in is already installed and configured for your organization.

 

Requirements

To use ADFS with Projector, you need the following components.

  • An Active Directory instance where all users have an email address attribute

  • A server running Microsoft Server 2012 or 2008. This guide uses screenshots from Server 2012R2.

  • An SSL certificate to sign your ADFS login page

  • Base64 encoded x.509 certificate

  • Your endpoint URL

  • An ACS URL

Relying Party Trusts

Steps to add Projector as a relying party trust.

Go to ADFS | Trust Relationships | Relying Party Trust, Choose Add Relying Party Trust.
 

 

Welcome

This starts the configuration wizard. Click Start.

 

Select Data Source

Choose Enter data about the relying party manually

 

Specify Display Name

Set Display Name to ProjectorPSA

 

Choose Profile

Choose the radio button for AD FS profile

 

Configure Certificate

Click Next

 

Configure URL

Tick the checkbox for Enable support for the SAML 2.0 WebSSO protocol. In the URL field enter your ACS URL. It will be in the format:

https://app.projectorpsa.com/Saml2Assert/YourAccountCode

Your account code is visible by logging into Management Portal and looking at the lower left of corner of the application. Or, you can ask Projector support for your ACS URL.

 

Configure Identifiers

Enter ProjectorPSA. Click Add.

 

Configure Multi-factor Authentication Now?

Choose radio button for I do not want to configure multi-factor authentication settings for this relyign party trust at this time

 

Choose Issuance Authorization Rules

Choose radio button Permit all users to access this relying party

 

Ready to Add Trust

No changes are necessary here. Click tabs to review your settings.

 

Finish

Tick the checkbox Open the Edit Claim Rules dialog for this relying party trust when the wizard closes

 

Claim Rules

After completing the wizard for adding a relying party trust, you'll end up here to create your claim rules. You can also reach this editor by going to the AD FS snap-in | Trust Relationships | Claims Provider Trusts.

You'll need to set up two claim rules to process incoming and outgoing requests.

LDAP Query

Follow these steps to create your first claim rule.

  1. Click Add Rule

  2. Choose Send LDAP Attributes as Claims

     

  3. Claim Rule Name: Email LDAP query

  4. Attribute Store: Active Directory

  5. LDAP Attribute: E-mail Address 

  6. Outgoing Claim Type: E-mail Address
     

  7. Click Finish