You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Select the check box for **Publish this claim description in federation metadata as a claim type that this federation service can accept**.
67
67
- Select the check box for **Publish this claim description in federation metadata as a claim type that this federation service can send**.
68
68
69
-
5. Click **Ok**.
69
+
1. Click **Ok**.
70
70
71
71
### Add the relying party trust
72
72
73
73
1. On the AD FS server, go to **Tools** > **AD FS management**.
74
-
2. In the navigation pane, select **Relying Party Trusts**.
75
-
3. Under **Actions**, select **Add Relying Party Trust**.
76
-
4. In the add relying party trust wizard select **Claims aware** and click**Start**.
77
-
5. In the **Select Data Source** section, use the option **Import data about the relying party published online or on a local network**. Specify this federation metadata URL- https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml. Click**Next**.
78
-
6. Leave the other settings in their default state. Continue to click**Next** and finally **Close** to finish the wizard.
74
+
1. In the navigation pane, select **Relying Party Trusts**.
75
+
1. Under **Actions**, select **Add Relying Party Trust**.
76
+
1. In the **Add Relying Party Trust** wizard, select **Claims aware**, and then select**Start**.
77
+
1. In the **Select Data Source** section, select the check box for **Import data about the relying party published online or on a local network**. Enter this federation metadata URL: `https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml`. Select**Next**.
78
+
1. Leave the other settings in their default options. Continue to select**Next**, and finally select **Close** to close the wizard.
79
79
80
80
### Create claims rules
81
-
1. Right-click the Relying Party Trust you just created and select **Edit Claim Issuance Policy**.
82
-
2. In the **Edit Claim Rules** wizard, select **Add Rule**.
83
-
3. In **Claim rule template**, select **Send LDAP Attributes as Claims**.
84
-
4. In **Configure Claim Rule**, specify the following values:
81
+
82
+
1. Right-click the relying party trust you created, and then select **Edit Claim Issuance Policy**.
83
+
1. In the **Edit Claim Rules** wizard, select **Add Rule**.
84
+
1. In **Claim rule template**, select **Send LDAP Attributes as Claims**.
85
+
1. In **Configure Claim Rule**, specify the following values:
85
86
86
87
-**Claim rule name**: Email claim rule
87
88
-**Attribute store**: Active Directory
88
89
-**LDAP Attribute**: E-Mail-Addresses
89
90
-**Outgoing Claim Type**: E-Mail Address
90
91
91
-
4. Select **Finish**.
92
-
5. Once more, click**Add Rule**.
93
-
6. In **Claim rule template**, select **Transform an Incoming Claim** and click**Next**.
94
-
7. In **Configure Claim Rule**, specify the following values:
92
+
1. Select **Finish**.
93
+
1. Select**Add Rule**.
94
+
1. In **Claim rule template**, select **Transform an Incoming Claim**, and then select**Next**.
95
+
1. In **Configure Claim Rule**, specify the following values:
95
96
96
97
-**Claim rule name**: Email transform rule
97
98
-**Incoming claim type**: E-mail Address
98
99
-**Outgoing claim type**: Name ID
99
100
-**Outgoing name ID format**: Persistent Identifier
100
101
- Select **Pass through all claim values**.
101
102
102
-
3. Click **Finish**.
103
-
4. The **Edit Claim Rules** window will show the new rules. Click **Apply**.
104
-
5. Click **OK**. The AD FS server is now configured for federation using the SAML 2.0 protocol.
103
+
1. Select **Finish**.
104
+
1. The **Edit Claim Rules** pane shows the new rules. Select **Apply**.
105
+
1. Select **OK**. The AD FS server is now configured for federation using the SAML 2.0 protocol.
106
+
107
+
## Configure AD FS for WS-Fed federation
105
108
106
-
## Configure AD FS for WS-Fed federation
107
109
Azure AD B2B can be configured to federate with IdPs that use the WS-Fed protocol with the specific requirements listed below. Currently, the two WS-Fed providers have been tested for compatibility with Azure AD include AD FS and Shibboleth. Here, we’ll use Active Directory Federation Services (AD FS) as an example of the WS-Fed IdP. For more information about establishing a relying party trust between a WS-Fed compliant provider with Azure AD, download the Azure AD Identity Provider Compatibility Docs.
108
110
109
111
To set up federation, the following attributes must be received in the WS-Fed message from the IdP. These attributes can be configured by linking to the online security token service XML file or by entering them manually. Step 12 in [Create a test AD FS instance](https://medium.com/in-the-weeds/create-a-test-active-directory-federation-services-3-0-instance-on-an-azure-virtual-machine-9071d978e8ed) describes how to find the AD FS endpoints or how to generate your metadata URL, for example `https://fs.iga.azure-test.net/federationmetadata/2007-06/federationmetadata.xml`.
0 commit comments