Microsoft Active Directory Federation Services Integration with SAML

ADFS is a software solution developed by Microsoft that can run as a component on Windows Server operating systems. It provides SSO to applications that cross organization boundaries by the secure sharing of entitlement rights and digital identity. AD FS can be configured to authenticate users stored in an LDAP directory (for more information, refer to the Microsoft documentation: Configure AD FS to authenticate users stored in LDAP directories).

This document explains how to configure Active Directory Federation Services (ADFS) and Invicti Platform for Single Sign-On.

How to configure Microsoft AD FS with SAML

There are two parts to this procedure:

• Step 1: Add a Relying Party Trust
• Step 2: Edit the Claim Issuance Policy

Step 1: Add a Relying Party Trust

1. Open Microsoft Active Directory Federation Services Management.
2. From the ADFS node, select Relying Party Trusts.
3. In the Actions panel, select Add Relying Party Trust.

4. In the Welcome step, click Start.

5. Select Enter data about the relying party manually, and click Next.

6. In the Display Name field, enter a display name, then click Next. The Configure Certificate step is displayed.
7. Accept the defaults by selecting Next. The Configure URL step is displayed.

8. Select Enable support for the SAML 2.0 WebSSO protocol.

9. Log in to Invicti Platform and from the menu, select Settings > Security & Access Control > SSO.
10. Turn on the Enable SSO toggle.
11. Select ADFS from the SSO Provider dropdown list.

12. Copy the URL from the SAML 2.0 Service URL field. Then, in the Microsoft ADFS Wizard, paste the URL into the Relying party SAML 2.0 SSO service URL field.
13. In the Microsoft ADFS Wizard, select Next. The Configure Identifiers step is displayed.
14. Copy the URL from the Identifier field in Invicti. Then, in the Microsoft ADFS Wizard, paste the URL into the Relying party trust identifier field.

15. Select Add, then Next. The Choose Access Control Policy step is displayed.
16. Select Permit everyone, then click Next. The Ready to Add Trust step is displayed.

17. Review your settings, and select Next. The Finish step is displayed.

18. Click Close.

Step 2: Edit the Claim Issuance Policy

1. Open Microsoft Active Directory Federation Services Management.
2. From the ADFS node, select Relying Party Trusts. The Relying Party Trust you have just created is listed in the Central Panel.
3. Right-click the relying party trust and choose Edit Claim Issuance Policy. The Edit Claim Issuance Policy dialog box is displayed.

4. Click Add Rule. The Add Transform Claim Rule wizard is displayed.
5. From the Claim rule template drop-down, select Send LDAP Attributes as Claims.
6. Click Next.

7. In the Claim rule name field, enter a name.
8. From the Attribute store drop-down, select Active Directory.
9. In the Mapping of LDAP attributes to outgoing claim types section, select the following attributes from the drop-down lists.

10. Click Finish to display the Edit Claim Issuance Policy window.
11. Click Add Rule.
12. Select Transform an Incoming Claim as the claim rule template to use and click Next.
13. Configure the Transforming an Incoming Claim as shown in the following image:

• Enter Claim rule name. In this example we use Email Transform.
• In Incoming claim type drop-down select: E-Mail Address.
• In Outgoing claim type drop-down select: Name ID.
• In Outgoing name ID format drop-down select: Email.

14. Click Finish.
15. Download ADFS SAML Metadata from https://<server-address>/FederationMetadata/2007-06/FederationMetadata.xml
16. Open the downloaded ADFS SAML metadata file and copy the URL located in the EntityDescriptor node > entityID attribute.

17. From Invicti Platform’s main menu select Settings > Security & Access Control > SSO. 
18. Turn on the Enable SSO toggle.
19. Select ADFS from the SSO Provider drop-down list.
20. Paste the URL from Step 16 into the  IdP Identifier field.
21. Copy the URL from the SingleSignOnService node>Location attribute field in the ADFS SAML metadata file.
22. Paste the URL into the SAML 2.0 Endpoint field in Invicti.
23. Copy the content of the X509 Certificate node (signing) in the ADFS SAML metadata file.
24. Paste it into the X.509 Certificate field in Invicti.

25. Select the checkboxes for signed assertions, encrypted assertions, or sign requests as needed.

26. If you enable any assertions or requests, a new section appears where you can generate a new certificate or upload an existing one.
27. Use the Invicti’s SSO Exemptions dropdown to select users who can log in to Invicti via password.
28. Click Save to finish the configuration.