How to Configure Microsoft Active Directory Federation Services Single Sign-On Integration with SAML

Category: Product Docs & FAQS - Last Updated: Thu, 24 May 2018 - by Netsparker Cloud Team

Using Security Assertion Markup Language (SAML), a user can use their managed account credentials to sign in to enterprise cloud applications via Single Sign-On (SSO). An Identity Provider (IdP) service provides administrators with a single place to manage all users and cloud applications. You don't have to manage individual user IDs and passwords tied to individual cloud applications for each of your users. An IdP service provides your users with a unified sign-on across all their enterprise cloud applications.

These instructions were prepared using Windows Server 2016, though other, recent versions should also work.

There are two parts to this procedure:

  • Part 1: Adding a Relying Party Trust
  • Part 2: Edit Claim Issuance Policy
How to Configure Microsoft Active Directory Federation Services Integration with SAML (Part 1: Adding a Relying Party Trust)
  1. Open Microsoft Active Directory Federation Services Management. The AD FS window is displayed.

  1. From the AD FS node, click Relying Party Trusts.
  2. In the Actions pane, click Add Relying Party Trust. The Add Relying Party Trust Wizard is displayed.

  1. In the Welcome step, click Start.

  1. Select Enter data about the relying party manually, and click Next.

  1. In the Display Name field, enter a display name and click Next. The Configure Certificate step is displayed.

  1. Accept the defaults by clicking Next. The Configure URL step is displayed.

  1. Select Enable support for the SAML 2.0 WebSSO protocol.
  2. Then log in to Netsparker Cloud, and from the main menu, click Settings, then Single Sign-On. The Single Sign-On window is displayed. Select the Active Directory Federation Services tab:
    • Next, copy the URL from the SAML 2.0 Service URL field
    • In the Microsoft AD FS Wizard, paste the URL into the Relying party SAML 2.0 SSO service URL field
  3. In the Microsoft AD FS Wizard, click Next. The Configure Identifiers step is displayed.

  1. In the AD DS tab in Netsparker Cloud's SSO window, copy the URL from the Identifier field.
  2. In the Microsoft AD FS Wizard, paste the URL into the Relying party trust identifier field. Click Add, then Next. The Choose Access Control Policy step is displayed

  1. Select Permit everyone and click Next. The Ready to Add Trust step is displayed.

  1. Review your settings, and click Next. The Finish step is displayed.

  1. Click Close.
How to Configure Microsoft Active Directory Federation Services Integration with SAML (Part 2: Edit Claim Issuance Policy)
  1. Open Microsoft Active Directory Federation Services Management. The AD FS window is displayed.

  1. From the AD FS node, click Relying Party Trusts. The Relying Party Trust that you have just created is listed in the central pane.

  1. Right click the relying party trust and select Edit Claim Issuance Policy. The Edit Claim Issuance Policy for NetsparkerCloud dialog box is displayed.

  1. Click Add Rule. The Add Transform Claim Rule wizard is displayed.

  1. From the Claim rule template dropdown, select Send LDAP Attributes as Claims.
  2. Click Next. The Configure Claim Rule step is displayed.

  1. In the Claim rule name field, enter a name.
  2. From the Attribute store dropdown, select Active Directory.
  3. In the Mapping of LDAP attributes to outgoing claim types section, select the following attributes from the drop-down lists.
LDAP Attributes Outgoing Claim Type
User-Principal-Name Name ID
Given-Name Given Name
Surname Surname
  1. Click Finish.
  2. Download AD FS SAML Metadata from https://<server-address>/FederationMetadata/2007-06/FederationMetadata.xml
  3. Open the downloaded AD FS SAML metadata file, and copy the URL located in the EntityDescriptor node>entityID attribute:
    • Then, log in to Netsparker Cloud, and from the main menu click Settings, then Single Sign-On. The Single Sign-On window is displayed. Select Active Directory Federation Services tab, and the paste the URL into Idp Identifier field.
    • Next, copy the URL from the SingleSignOnService node>Location attribute field.
    • Then in Netsparker Cloud's Single Sign-On window, paste the URL into SAML 2.0 Endpoint field.
    • Finally, copy the content of the X509Certificate node (signing).
    • Then in Netsparker Cloud's Single Sign-On window, paste it into the X.509 Certificate field.

  1. In Netsparker Cloud's Single Sign-On window, click Save Changes.

Netsparker

Dead accurate, fast & easy-to-use Web Application Security Scanner

GET A DEMO