Setting up single sign-on using Active Directory with ADFS and SAML

Workpath supports single sign-on (SSO) logins through SAML 2.0. A SAML 2.0 identity provider (IDP) can take many forms, one of which is a self-hosted Active Directory Federation Services (ADFS) server. ADFS is a service provided by Microsoft as a standard role for Windows Server that provides a web login using existing Active Directory credentials.

Configuration of Workpath

1. Please provide your Workpath Account Manager with the federation metadata of your AD FS installation. The metadata can usually be accessed from a "/FederationMetadata/2007-06/FederationMetadata.xml" endpoint on your AD FS server, e.g. "https://adfs.contoso.com/FederationMetadata/2007-06/FederationMetadata.xml".
2. Your Workpath Account Manager will then configure the account on Workpath's side accordingly. Proceed to configure the Relying Party Trust in AD FS.

Add a Relying Party Trust

1. Download the SP metadata for Workpath from the URL provided by your Workpath Account Manager. It follows this format: https://api.workpath.com/v1/saml/metadata/account-subdomain (where account-subdomain is your company name e.g. contoso).
2. Open Server Manager. Click Tools on the top right, then select AD FS Management from the menu.
   
   
   
   
3. Add a Relying Party Trust by right-clicking Relying Party Trusts and selecting Add Relying Party Trust....
   
   
   
   
4. Click Start on the bottom right of the Welcome Screen.
   
   
   
   
5. Select Import data about the relying party from a file, click Browse... and select the downloaded metadata file (you might have to allow "All Files (*.*)" in the open file dialog) and click Next.
   
   
   
   
6. Use "Workpath" as "Display name" and click Next.
   
   
   
   
   
7. Select Permit everyone from the Access Control Policy list, then click Next.
   
   
   
   
8. On the Ready to Add Trust screen, click Next.
   
   
   
   
9. On the Finish screen, click on Close.
   
   
   
   

Create Claim Rules

Once the Relying Party Trust has been created, proceed by configuring the required claims.

1. Right-click on Workpath, then select Edit Claim Issuance Policy....
   
   
   
   
2. Click on Add Rule.
   
   
   
   
3. Select Send LDAP Attributes as Claims, click Next.
   
   
   
   
4. Name the rule "Get Attributes", select "Active Directory" as Attribute store and configure following mapping:
   
   

   LDAP Attribute	Outgoing Claim Type
   E-Mail-Addresses	E-Mail Address
   Given-Name	first_name
   Surname	last_name

   
   Click on Finish.
   
   
   
   
5. Click on Add Rule... .
6. Click the dropdown below Claim rule template and select Transform an Incoming Claim, then click Next >.
   
   
   
   
7. Name the rule "Transform", select E-Mail Address as incoming claim type, Name ID as outgoing claim type and Email as outgoing name ID format. Click Finish.
   
   
   
   
8. Finish Claim Issuance Policy configuration by clicking OK.
   
   

Testing Single Sign-On

Once the configuration is completed in AD FS and Workpath, it is time to test the single sign-on.

1. Open the login page of your Workpath account (https://{account-subdomain}.workpath.com) and click on the Login Button.
   
   
   
   
2. Enter your Active Directory credentials, if you are not logged in yet.
   
   
   
   
3. Hurray! You are now logged in to Workpath with your Active Directory account.