Single Sign-On in Workfront Proof: AD FS configuration
If you are an administrator on your AD server, you can install and configure AD FS.
Installing and Configuring AD FS
-
Download AD FS 2.0 to your computer.
-
Open the downloaded AdfsSetup.exe file to start the ADFS (Active Directory Federation Services) Installation Wizard.
-
On the Server Role screen, select one of the options (you need at a minimum a Federation Server).
-
If you do not want to expose IIS on your AD server to the internet (ports 80 and 443 for HTTP and HTTPS), you can first set up a Federation Server behind the firewall, then build a second Federation Server Proxy that passes requests through the firewall to the Federation Server.
-
Once you complete the AD FS setup, select Start the AD FS 2.0 Management snap-in, then click Finish. Once this is completed, the AD FS 2.0 Management window should open right away. If not, you can open it from Start > Administrative Tools > AD FS 2.0 Management. This is the main AD FS control application.
-
Begin by clicking AD FS 2.0 Federation Server Configuration Wizard.
This will help you to configure AD FS and connect it to both the Internet via IIS and to AD. -
If you are configuring a new AD FS server, select Create a new Federation Service.
-
Select Stand-alone federation server (for testing and evaluation purposes).
-
For high availability and load balancing, click New federation server farm.
-
Specify your Federation Service name.
By default the configuration wizard retrieves the SSL certificate bound to the Default Web Site in IIS and will use the subject name specified there. If you use a wildcard certificate you will need to enter the Federation Service name.
If there is no SSL certificate configured in IIS, then the configuration wizard will search in the local computer certificate store for any valid certificates. These display in the SSL certificate drop-down. If there are no certificates found, you can use the Server Certificate Generator in IIS to create one. -
Continue with the configuration, and click Close once it is complete.
Configuring Workfront Proof Single Sign-On
If you are a Workfront Proof administrator, you can configure Single Sign-On on the Workfront Proof side. For more information, see Single Sign-On in Workfront Proof.
-
Click Settings > Account Settings, then open the Single sign-on tab.
-
In the SSO URL box, paste your Entity ID.
The following is an example of an Entity ID:
http://<adfs.your-company.com>/adfs/services/trust
Your Entity ID can be found in your Federation Metadata XML file.
-
Federation Metadata is found in the AD FS 2.0 snap-in > Service > Endpoints folder. In the Metadata section, locate the one with the Federation Metadata type. To view metadata, paste this endpoint in your browser. You can also go to this link directly: https://<adfs.your-company.com>/FederationMetadata/2007-06/FederationMetadata.xml after replacing the {adfs.your-company.com} with your own details.
-
In the Login URL box, paste your SSO login.
-
The following is an example of an SSO login:
-
http://<adfs.your-company.com>/adfs/ls.
-
This link can be located in the Federation Metadata XML file.
-
In the Logout URL box, enter the link and save.
The following is an example of a Logout URL:
https://<adfs.your-company.com>/adfs/ls/?wa=wsignout1.0-
Go to your AD FS manager > Trust Relationships > Relying Party Trusts - ProofHQ properties.
-
Under the Endpoints, click Add and entry with the following details:
- Endpoint Type = SAML Logout
- Binding = POST
- URL = https://<adfs.your-company.com>/adfs/ls/?wa=wsignout1.0
- This step can be completed after configuring the Relying Party Trust (see below) in your AD FS.
-
In the Certificate fingerprint box, enter the data from your certificate.
-
Go to your ADFS 2.0 snap-in navigate to Service > Certificates > Token-signing.
-
Right-click on this entry to view the certificate.
-
From the Certificate Details tab copy the Thumbprint, and paste it in the Workfront Proof Single Sign-On configuration tab.
-
The fingerprint characters can be separated with colons or spaces, but we do recommend removing these. If you have any troubles with your Single Sign-On configuration, please contact the Customer Support team.
-
Adding a Relying Party Trust
Once configuration is complete, you need to work in the Relying Party Trusts section in your AD FS.
-
Navigate to Trust Relationships > Relying Party Trusts folder, then click Add a Relying Party Trust to start the configuration wizard.
-
Select your data source.
All metadata for your ProofHQ account is located under a link like this:
https://<yoursubdomain*>.proofhq.com/saml/module.php/saml/sp/metadata.php/phq
This will configures most of the Relying Party Trust.note note NOTE - If you’re having any troubles with establishing the connection from the URL, save the metadata as a file and choose to import data from a file.
- When you have a full Custom domain (e.g., www.your-proofing.com) configured on your ProofHQ account replace the whole “{yoursubdomain}.proofhq.com” part with your own domain to create your ProofHQ metadata link.
Configuring Claim Rules
Once your Relying Party Trust configuration is complete, you are ready to configure the claim rules to complete the set up. You will configure two claim rules for ProofHQ: E-mail and Name ID.
-
Open the Edit Claim Rules dialog box.
-
Go to ProofHQ Relying Party Trust, then click Edit Claim Rules (1).
The pop-up should automatically open if you selected this option at the end of configuring the trust. -
Click Add Rule (2) to open the claim configuration window.
- E-mail (Send LDAP Attributes as Claims rule template)
- NameID (Transform an Incoming Claim rule template)