Microsoft ADFS
- 2 Minutes to read
- Print
- PDF
Microsoft ADFS
- 2 Minutes to read
- Print
- PDF
Article summary
Did you find this summary helpful?
Thank you for your feedback
You set up SAML single sign-on support in ADFS and gather the information you need to connect the CTERA Portal to ADFS.
To get the SAML single sign-on information:
- Login to the Windows Server ADFS machine as the administrator.
- Open ADFS Management.Note
Microsoft changes the look and feel of Azure from time to time. The following procedure and screens might have changed but the basic procedure will be the same.
- In the left pane navigation tree, select Trust Relationships and right-click Relying Party Trusts.
- Click Add Relying Party Trust.
- Click Start.
- Choose the Enter data about the relying party manually option and click Next.
- Enter a display name for the relying party and optionally add notes about the party and click Next.
- Choose the AD FS Profile option and click Next.
- Optionally, if you want to encrypt claims sent to the relying party, browse to the CTERA Portal certificate and select it and click Open.
The issuer, subject, effective date and expiry date information for the certificate is displayed. - Click Next.
- Check Enable support for the SAML 2.0 WebSSO protocol and enter the CTERA Portal URL followed by /SAML, as in the following example:
https://exampleportal.ctera.me/admin/saml
NoteFor a team or reseller administrator to be automatically redirected, use https://fully_qualified_domain_name/ServicesPortal/saml.
- Click Next.
- Set the Relying party trust identifier and click Add. For example,
ctera-adfs
You use the Relying party trust identifier in the CTERA Portal Entity ID/Issuer ID field, in the procedure To configure SAML single sign-on, described in Defining SAML SSO in the CTERA Portal, when setting up SAML in the portal. - Click Next.
- Leave the default to allow all users access, unless you want to restrict the users with access to the portal to users for whom you add issuance authorization rules, as described in the ADFS documentation.
- Click Next.
A summary of the wizard steps is displayed in the tabs. - Select the Signature tab and import the CTERA Portal Certificate.
- Click Next.
- Check the Open Edit Claim Rules dialog for this relying trust when the wizard closes and click Close.
The Edit Claim Rules window for the relying party is displayed.
- Click Add Rule.
- Select Send LDAP Attributes as Claims for the Claim rule template and click Next.
- Enter the following:
Claim rule name – A name for the rule.
Attribute store – Select the store from the list, for example, Active Directory.
LDAP Attribute – Use User-Principal-Name.
Outgoing Claim Type – Select Name ID. - Click Finish.
- Click OK.
- In the left pane navigation tree, select Service > Certificates, right-click the certificate under Token-signing and click View Certificate.
- Select the Details tab and click Copy to File.
- Click Next in the Certificate Export wizard and select the Base-64 encoded X.509 option.
- Click Next and enter a file name.
- Click Next and then Finish.
You upload this certificate when setting up SAML in the CTERA Portal.
Encrypting the SAML Response
When using ADFS for SAML to sign in to the portal, the SAML response can be encrypted, as follows:
- Add the portal certificate to the relaying party in ADFS.
- Using SSH, log in as root to your CTERA Portal server.
- Run the following command in ADFS PowerShell:
set-ADFSRelyingPartyTrust –TargetName “<relaying party name>” –EncryptClaims $True
For example,
set-ADFSRelyingPartyTrust –TargetName “CTERA Portal” –EncryptClaims $True
To turn the encryption off, run the command but set to $False
Was this article helpful?