Cbox ID
AD FS
AD FS
Single sign-on (SAML 2.0)
In the portal, choose AD FS under Enterprise SSO and Start with AD FS. Then, in AD FS:
- In AD FS Management, under Actions, click Add Relying Party Trust, choose Claims aware, and click Start.
- Choose "Import data about the relying party published online or on a local network" and enter our metadata URL below — or enter the data manually.
- Entering it manually: select "Enable support for the SAML 2.0 WebSSO protocol" and enter our ACS URL, then add our entity ID as an identifier.
- Choose an access control policy and finish the wizard.
- In Edit Claim Issuance Policy, add a Send LDAP Attributes as Claims rule (E-Mail-Addresses → E-Mail Address) and a Transform an Incoming Claim rule (E-Mail Address → Name ID).
- Send us your federation metadata URL: https://<adfs-host>/federationmetadata/2007-06/federationmetadata.xml.
The values the portal shows
| AD FS field | Value |
|---|---|
| Federation metadata address (host name or URL) (Select Data Source) | The portal's SP metadata URL (https://…/sso/saml/…/metadata) |
| Relying party SAML 2.0 SSO service URL (Configure URL) | The portal's ACS URL (https://…/sso/saml/…/acs) |
| Relying party identifier (Configure Identifiers) | The portal's entity ID (https://…/sso/saml/…) |
| Outgoing claim type (Transform an Incoming Claim (from E-Mail Address)) | Name ID |
What to bring back
Copy https://<adfs-host>/federationmetadata/2007-06/federationmetadata.xml and paste it into the portal's Metadata URL or XML.
The assertion must be signed, and must carry the person's email address as an attribute or as a NameID in the emailAddress format. See Any SAML 2.0 provider for the details.
AD FS's own guide: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-relying-party-trust.
Then verify your domain and turn single sign-on on in the portal: Enterprise SSO.
Related
- Identity provider guides — every provider the portal guides you through.
- Enterprise SSO — the portal's five steps.