SSO - ADFS (Windows Server)
Requirements
Before starting this configuration, you need to make sure you have the following:
- An ADFS working with SAML2
- Received the "SSO - Configuration Information" document from Wordbee
- Received the public certificate from Wordbee
- A SSL certificate to sign your ADFS
Step 1 - Adding a Relying Party Trust
A) Use the "Add relying Party Trust" wizard
B) Select "Enter data about the relying party manually"
C) Select a display name
This display name is just the name under which you will find your configuration on your ADFS. It has no impact on the configuration.
D) Select "AD FS profile"
E) No certificate required here
F) Enable support for the SAML 2.0 WebSSO protocol
The Relying Party SAML 2.0 SSO service URL (also called Endpoint URL) is the URL which will forward the users to your authentication portal.
It should have been provided by Wordbee in the "SSO - Configuration Information" document.
G) Relying Party trust identifier
The Relying party trust identifier (also called Service Principal Name) is the unique ID that will be used between our services. A suggested ID should have been provided by Wordbee in the "SSO - Configuration Information" document.
It can be changed if you prefer but should be the same on Service Provider and on Identification Provider, please let us know if our suggestion doesn't match your preferences.
H) This screen allows you to configure multifactor, which is out of scope of this guide.
I) Permit all users to access this relying party
It is possible to set the default behavior as "deny" and grant only specific users access to your platform, but this configuration is out of scope for this guide.
The next steps of the wizard are only to verify and finish your configuration. Uncheck the box "Open the Edit Claim Rules dialog...", we will configure them later.
J) Signature encryption
Some configuration can not be done using this Wizard, to proceed further, open the properties of the freshly created relying party trust.
It is located in your ADFS management console in "Trust Relationships > Relying Party Trusts" under the display name you set earlier.
On the "Signature" tab, upload the certificate provided by Wordbee.
K) Hash Algorithm
Under "advanced" tab, make sure SHA-256 is selected.
Step 2 - Creating claim rules
Claim rules are used here to define which user information will be send to our server.
You can configure them in your ADFS management console in "Trust Relationships > Relying Party Trusts", right click on the Wordbee-Translator Relying Party Trust and "Edit Claim rules"
A) "Add Rule" and "Send LDAP Attributes as Claims"
B) Select the attributes to send
To make it work with Wordbee-Translator, you will at least need to send e-mail-addresses as "e-mail address". More attributes can be requested by Wordbee to match your specific needs.
"Claim rule name" is just a friendly name and "Attribute store" should be Active Directory.
Step 4 - Complete configuration document for Wordbee integration
Once this is done, your ADFS is ready, we need you to send your public certificate and fulfill the "SSO - Configuration Information" document.
A) Extract and send the certificate
This certificate can be found on your ADFS management console, under Service > Certificates, select the token signing cert and clic "View Certificate"
Go to details tab, clic "copy to file"
This should open the Certificate export wizard, export it in Base 64 file.
This file does not include the private key and can be safely sent via mail.
B) SSO - Configuration information document
In this document, we expect you to fill the "Contact details" part and the "Identity Provider Data for the AD FS PRODUCTION environment"
- Identity Provider Name
The Identity Provider Name is also called "Federation Service Identifier" and can be found in the Federation Service Properties of your ADFS as shown on the screenshots below.
- Single Sign On service URL
In Service > Endpoints, you can find your SSO Service URL
- Federation Metadata URL
In the same folder, a bit below, you can find your metadata
