Configuring Windows Server with AD FS for GoodData SAML SSO

A variety of identity providers can be used with GoodData.

This article describes how to use Active Directory Federation Services (AD FS) for the security token service. For information on configuring the identity provider using SAML, see SAML SSO with GoodData.

Prerequisites

Before you start, make sure you have the following in place:

• Windows Server

• Active Directory Domain Services

• AD FS 2.0 or higher

• DNS

• TLS certificate (if you do not have a certificate, you can generate a self-signed certificate using IIS; you can use a self-signed certificate for testing).

Process

1. Run the AD FS configuration.
2. Add a relying party trust to the AD FS configuration database.
3. Add transform claim rules to the relying party trust.
4. Specify the response signature.
5. Download federation metadata.
6. Finalize the configuration.

Run the AD FS configuration

Steps:

1. Open Server Manager, and click AD FS. 

   
   

2. On the notification bar, click More… . The AD FS configuration wizard opens the Welcome page.

3. Select Create the first federation server in a federation server farm, and click Next. 

   
   

4. Select the user, and click Next. The user must have privileges to configure AD FS. 

   
   

5. Select the TLS certificate and the federation service, type the preferred display name of the federation service, and click Next.

   AD FS may auto-renew certificates from time to time using the AutoCertificateRollover property.

   If the certificate expires or gets renewed, deliver the new certificate or metadata to GoodData.

6. Select Use an existing domain user account… , and enter the service account details. Click Next. 

   
   

7. Select Create a database on this server using Windows Internal Database. Click Next. 

   
   

8. Review the options, and click Next. 

   
   
    The prerequisite check runs. A success message appears.

9. Click Configure to finish. 

   
   

Add a relying party trust to the AD FS configuration database

Before you start, download the XML configuration file from here.

This file contains configuration parameters for setting up a relying party trust on your side.

Steps:

1. Run the AD FS management application.
2. Click Action -> Add Relying Party Trust. The relying party trust wizard opens the Welcome page.
3. Click Start.
4. Select Import data about the relying party from a file, and specify the path to the downloaded XML file.
5. Click Next.
6. Type a display name (for example, ‘gooddata.com’), and click Next.
7. Select I do not want to configure multi-factor authentication settings… , and click Next.
8. Select Permit all users to access this relying party, and click Next.
9. Review the options you have specified, and click Next. The relying party trust is added to the AD FS configuration database.
10. Select Open the Edit Claim Rules dialog for this relying party trust when the wizard closes, and click Close. The wizard closes. The dialog for editing claim rules opens.

Add transform claim rules to the relying party trust

Now, you must add two transform rules.

Steps:

1. In the dialog for editing claim rules, click Add Rule… . The wizard for adding rules opens.
2. Select Send LDAP Attributes as Claims for the rule template and click Next.
3. Configure the rule: 
   1. Type a name for the rule (for example, ‘email to email’).
   2. For the attribute store, select Active Directory.
   3. Map LDAP attributes to outgoing claim types like the following: E-Mail-Addresses < > Email Address
4. Click Finish.
5. Click Add Rule… again.
6. Select Transform an incoming claim for the rule template, and click Next.
7. Configure the rule: 
   1. Type a name for the rule (for example, ‘email to nameid’).
   2. For the incoming claim type, select Email address.
   3. For the outgoing claim type, select Name ID.
   4. For the outgoing name ID format, select Email.
   5. From the option buttons, select Pass through all claim rules.
8. Click Finish.
9. In the dialog for editing claim rules, click OK to save and apply your changes.

Specify the response signature

Specifies the response signatures that the relying party expects.

Open the PowerShell console, and run the following command:

Set-ADFSRelyingPartyTrust -TargetIdentifier "https://{your-subdomain-name}.gooddata.com" -Identifier "https://{your-subdomain-name}.gooddata.com" -SamlResponseSignature 'MessageAndAssertion'

Configure the SSO

Steps:

1. Open a browser, and go to https://localhost/FederationMetadata/2007-06/FederationMetadata.xml.
2. Determine which SSO scenario you are configuring and follow the relevant instructions:
   • If configuring for a Service Provider-initiated scenario, see SAML SSO with GoodData - Service Provider-initiated Scenario.
   • If configuring for an Identity Provider-initiated scenario, see SAML SSO with GoodData - Identity Provider-initiated Scenario.

Finalize the configuration

Steps:

1. Using the user provisioning API, set the ssoProvider parameter for the GoodData user to the value that you created.

2. Open a browser, and go to https://localhost/adfs/ls/idpinitiatedsignon.aspx.

3. Click Sign in to one of the following sites, and select the relying party trust that you configured in Step 2 (in our example, it’s ‘gooddata.com’).

4. Click Sign in.

5. If prompted, use your AD user account to log in to GoodData.

   Your GoodData login email and the email set for your user in AD must match.

You now have an AD FS SSO implementation for GoodData.