Connect AD FS SAML

Learn how to configure a connection to Microsoft Active Directory Federation Services (AD FS)

Introduction

Each SSO Identity Provider requires specific information to create and configure a new Connection. Often, the information required to create a Connection will differ by Identity Provider.

To create an AD FS SAML Connection, you'll need two pieces of information: an SP Metadata file and an IDP Metadata URL.

1

Configure a Relying Party Trust

Open the AD FS Management console.

Click “Relying Party Trusts” on the left sidebar.

Open the “AD FS Relying Party Trust Wizard” by clicking “Add Relying Party Trust...” on the right sidebar.

Select “Claims aware” and then “Start”.

Download the provided Metadata file from WorkOS.

Select “Import data about the relying party from a file,” then select the SP Metadata file you downloaded, then click “Next”.

Select “Permit everyone” and then “Next”.

2

Choose Access Policy

Click the “Endpoints” tab and confirm that the “SAML Assertion Consumer Endpoints” matches the URL below and click “Next”.

Confirm this URL matches the SAML Assertion Consumer Endpointhttps://auth.workos.com/sso/saml/acs/:id

Select “Configure claims issuance policy for this application” and “Close”.

3

Configure Claims Issuance Policy

Click “Add Rule” in the “Edit Claims Issuance Policy” window.

Select “Send LDAP Attributes as Claims” and then “Next”.

Submit “Attributes” as “Claim rule name:”

Select “Active Directory” as “Attribute Store”

Configure the following Attribute mappings:

Click “OK”.

4

Upload Metadata URL

Next you will want to obtain the Metadata URL from your ADFS server. ADFS publishes its metadata to a standard URL by default: (https://SERVER/federationmetadata/2007-06/federationmetadata.xml) where "SERVER" is your federation service FQDN. You can also find your ADFS Federation Metadata URL through the AD FS Management in "AD FS -> Service -> Endpoints" and navigate to the Metadata section.

Once you have obtained the Metadata URL you will then navigate to the connection settings in WorkOS, click "Edit Metadata configuration", and upload the Metadata URL.

Once uploaded the connection will be verified and linked!