--- title: "Microsoft ADFS" slug: "microsoft-adfs-7-1" tags: ["Portal", "8.3"] updated: 2026-08-24T09:23:55Z published: 2026-08-24T09:23:55Z canonical: "kb.ctera.com/microsoft-adfs-7-1" --- > ## Documentation Index > Fetch the complete documentation index at: https://kb.ctera.com/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft ADFS You set up SAML single sign-on support in ADFS and gather the information you need to connect the CTERA Portal to ADFS. **To get the SAML single sign-on information:** 1. Login to the Windows Server ADFS machine as the administrator. 2. Open **ADFS Management**. **Note** Microsoft changes the look and feel of Windows Server from time to time. The following procedure and screens might have changed but the basic procedure will be the same. 3. In the left pane navigation tree, select **Trust Relationships** and right-click **Relying Party Trusts**. 4. Click **Add Relying Party Trust**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-XO00WWNA.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 5. Click **Start**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-JLZ0UYG2.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 6. Choose the **Enter data about the relying party manually** option and click **Next**. 7. Enter a display name for the relying party and optionally add notes about the party and click **Next**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-XNIN9NRB.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 8. Choose the **AD FS Profile** option and click **Next**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-Q5B20EYC.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 9. Optionally, if you want to encrypt claims sent to the relying party, browse to the CTERA Portal certificate and select it and click **Open**. The issuer, subject, effective date and expiry date information for the certificate is displayed. 10. Click **Next**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-LLA449KQ.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 11. Check **Enable support for the SAML 2.0 WebSSO protocol** and enter the CTERA Portal URL followed by **/SAML**, as in the following example: `https://exampleportal.ctera.me/admin/saml` **Note** For a team administrator to be automatically redirected, use *https://fully_qualified_domain_name/ServicesPortal/saml*. 12. Click **Next**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-NO2C0CWA.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 13. Set the **Relying party trust identifier** and click **Add**. For example, `ctera-adfs` You use the **Relying party trust identifier** in the CTERA Portal **Entity ID/Issuer ID** field, in the procedure *To configure SAML single sign-on*, described in [Defining SAML SSO in the CTERA Portal](/v1/docs/defining-saml-sso-in-the-ctera-portal-4-1), when setting up SAML in the portal. 14. Click **Next**. 15. Leave the default to allow all users access, unless you want to restrict the users with access to the portal to users for whom you add issuance authorization rules, as described in the ADFS documentation. 16. Click **Next**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-9TS6KMHB.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) A summary of the wizard steps is displayed in the tabs. 17. Select the **Signature** tab and import the CTERA Portal Certificate. 18. Click **Next**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-GV94D3LZ.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 19. Check the **Open Edit Claim Rules dialog for this relying trust when the wizard closes** and click **Close**. The **Edit Claim Rules** window for the relying party is displayed. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-FNEU3MI1.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 20. Click **Add Rule**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-F0GF3HFA.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 21. Select **Send LDAP Attributes as Claims** for the **Claim rule template** and click **Next**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-W30S7LAD.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 22. Enter the following: **Claim rule name** – A name for the rule. **Attribute store** – Select the store from the list, for example, Active Directory. **LDAP Attribute** – Use **User-Principal-Name**. **Outgoing Claim Type** – Select **Name ID**. 23. Click **Finish**. 24. Click **OK**. 25. In the left pane navigation tree, select **Service > Certificates**, right-click the certificate under **Token-signing** and click **View Certificate**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-69NDZNSC.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 26. Select the **Details** tab and click **Copy to File**. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-2GCJFEVM.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 27. Click **Next** in the **Certificate Export** wizard and select the **Base-64 encoded X.509** option. ![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-A72EUSP2.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A42Z&se=2026-11-11T05%3A43%3A42Z&sr=c&sp=r&sig=bx%2BeVm9jOPvGobEMh7FkowOHm1jbkxcJBM%2BB%2F%2B%2FjjZk%3D) 28. Click **Next** and enter a file name. 29. Click **Next** and then **Finish**. You upload this certificate when setting up SAML in the CTERA Portal. ## Encrypting the SAML Response When using ADFS for SAML to sign in to the portal, the SAML response can be encrypted, as follows: 1. Add the portal certificate to the relaying party in ADFS. 2. Using SSH, log in as root to your CTERA Portal server. 3. Run the following command in ADFS PowerShell: `set-ADFSRelyingPartyTrust –TargetName “<relaying party name>” –EncryptClaims $True` For example, `set-ADFSRelyingPartyTrust –TargetName “CTERA Portal” –EncryptClaims $True` To turn the encryption off, run the command but set to `$False`