Microsoft AD FS SAML2 SSO

Introduction

The Microsoft AD FS (Active Directory Federation Services) is an Identity Provider (IdP) developed by Microsoft to provide a Windows based self-hosted (on premise) version. You can connect an enterprise application over SAML2 to AD FS and manage, who can log in to view Single Sign On in the connected application. Define which user attributes you want to synchronize between AD FS and the connected application. Flexopus supports a Microsoft AD FS integration via SAML for Single Sign On.

SAML2 Instruction Manual

STEP 1 - Trust party setup

• Go to your Microsoft AD FS management console as an AD FS administrator.
• Select the Relying Party Trusts folder.
• In the Actions sidebar, click on the default setting Relying Party Trust and then click Start. This opens the Add Relying Party Trust Wizard.
• In the popup, select the first option as a data source:
  Import data about the relying party published online or on a local network.

https://{your-flexopus-domain}/internal-api/auth/integrations/saml2/metadata

To find your Federation metadata address, follow these steps:

1. Navigate to your Flexopus instance.
2. Go to Dashboard > Settings > Authentication.
3. Click on Add provider.
4. You can find the Metadata URL at the top of the page.

1. Display Name: Enter Flexopus.
2. Choose Access Control Policy: Select Permit Everyone.
   (Depending on your internal policies, you may choose a more suitable policy.)
3. Ready to add Trust: You can skip this step and the next two steps.
4. Complete the wizard afterward.

STEP 2/A - Setting the “Claim Rule”

• On the right side, select Edit Claim Issuance Policy.
• Click on Add rule.
• Select the option Send Claims Using a Custom Rule.

Enter the rule name Basic Attributes and set the following custom rule:

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", "jobtitle", "department"), query = ";userPrincipalName,displayName,givenName,sn,mail,title,department;{0}", param = c.Value);

Click on Finish

Let's repeat the steps:

1. On the right side, select Edit Claim Issuance Policy.
2. Click on Add rule.
3. Select the option Send Claims Using a Custom Rule.
4. Enter the rule name: NameIDFormat.
5. Set the following custom rule:

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent");

6. Click on Finish

STEP 2B - Manual setting of assignments

• On the right side, select Edit Claim Issuance Policy.
• Click on Add rule.
• Select Custom Rule Type: Send LDAP Attributes as Claims.

1. Enter the rule name: basic attributes.
2. Select the Attribute Store: Active Directory.
3. Set the attribute mappings as listed below.
   (Note that jobtitle and department are optional, but we recommend connecting them.)

This setup ensures the proper mapping of user attributes from Active Directory to Flexopus.

• Afterward, select Add rule again.
• Select Transform an Incoming Claim.
• In the final step, set the Name ID assignment:Incoming claim type: UPNOutgoing claim type: Name IDOutgoing Name ID format: Persistent Identifier

• Click Finish.

STEP 3 - Configure Flexopus for the SSO

• Navigate to AD FS > Service > Endpoints.
• Copy the Federation Metadata (metadata-endpoint-path).
• Based on this path, create your metadata URL, which will look like this:
  https://<your-adfs-domain>/<metadata-endpoint-path>

https://{your-adfs-server-url}/{metadata-endpoint-path}

In Flexopus, navigate to Dashboard > Settings > Authentication and select the previously created SAML2 provider. Paste the URL into the Metadata URL field and enable the SAML2 module.

Enter the name of the SAML2 Login button, which will be displayed on the login page.
Recommendation: Use SSO Login.
(Optional) Enable the synchronization of the fields that you configured in the SAML2 settings, such as jobtitle or department.

In the security settings, set the allowed domains for SSO by entering a * (star) and pressing ENTER. This allows every user configured in your Active Directory to log in.

By default, SAML2 SSO users are automatically registered after their first login attempt. This simplifies the process, as you won’t need to manually create user profiles before the first login. You can disable this setting, but it's not recommended.

Save your settings at the bottom.

STEP 4 - Test SSO

Open Flexopus in a new incognito window and test the login:
https://{your-company}.flexopus.com/ or in case you have a custom domain, then go to the custom domain.

You should be able to log in with an existing or a new user, depending on how you configured the access rights in your Azure Active Directory and Flexopus.

Once the SAML2 SSO is successfully configured, you can optionally disable the email and password login and enforce Single Sign-On for all users. Navigate to Dashboard > Settings > Authentication, where you will find two options:

1. Disable password login: This disables all email and password login forms.
2. Hide login form: This hides the login form on the main page, while a secondary form remains accessible at ../dashboard/auth/login for backup admin users.

(Optional) Sending groups

Microsoft AD FS does not offer the possibility to synchronize user groups through the SCIM API. However, you can use a workaround by sending groups via a SAML2 attribute. You can send the groups associated with a user using the memberOf SAML2 attribute. This attribute sends an array of groups that the user is supposed to be associated with.

STEP 1 - Configure AD FS

• Select the option Edit Claim Issuance Policy.
• Click on Add rule.

In case you did the configuration with the 2A Method:

Create a rule with the name group membership and paste the following rule:

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"] => issue(store = "Active Directory", types = ("memberOf"), query = ";memberOf;{0}", param = c.Value);

In case you did the configuration with the 2B Method:

• Custom Rule Type: Select Send LDAP Attributes as Claims.
• Create the rule with the name: group membership.
• Attribute Store: Select Active Directory.
• Add the following attribute:

Your Issuance Transform Rules should look like this:

STEP 2 - Configure Flexopus

To receive and process the additional attribute at Flexopus, follow these steps:

1. Go to Dashboard > Settings > Authentication.
2. Select the previously created SAML2 SSO provider.
3. Change the setting for the Synchronize groups option from Off to AD FS.

4. Save the setting in the bottom.

STEP 3 - Test configuration

• Assign groups to your test user in AD FS. The assigned groups will be sent to Flexopus when you log in with your user.
• Open Flexopus in a new incognito window and test the login:
  https://{your-company}.flexopus.com/ or use your custom domain if applicable.
• You need to initiate a new login for the groups to be exchanged. The SAML2 protocol only exchanges data between your IdP and Flexopus when you log in.

After the login, the groups received via memberOf will be assigned as external groups to the users, and any previously assigned external groups will be detached. The internal groups managed within Flexopus will remain unchanged.

Groups are identified by their names, which are always unique:

• If Flexopus receives a group name that already exists as an internal group, the internal group will be converted to an external group.
• If Flexopus receives a new group name, it will create the group as an external group.

Learn more about the groups here: (link to follow).

User groups

Learn how to manage user groups in Flexopus for effective access control and reservation rights.

Flexopus Help CenterDaniel Fafula

Trouble Shooting and FAQ