ADFS

This document describes how to configure Single Sign-on when Active Directory Federated System (ADFS) is your identity provider.

In this document, you’ll learn how to integrate Chakra with ADFS. When you integrate Chakra with ADFS, you can:

• Control in ADFS who has access to Chakra.
• Enable your users to be automatically signed-in to Chakra with their ADFS accounts.
• Manage your accounts in one central location - the ADFS portal.

Prerequisites

To set-up and use ADFS and Chakra Single Sign-on (SSO) feature:

• An ADFS Server access.
• You need to have administrator access to your organization’s ADFS Server.
• You need to have administrator access on Chakra.

Actions to be done on Chakra

1. Go to Admin → SSO & Authentication
2. Add the ADFS provider from “Add Provider”
3. Go to the ADFS Provider details page and copy the values for “SP ACS URL” and “SP Entity ID”. These values will be used in steps 8 & 9 below - “Actions to be performed on ADFS Server”
4. Add the ADFS Sign-in URL and ADFS Sign-out URL
5. ASFS Public X509 Certificate which you will get in the Step 8 of ADFS Certificate Thumbprint

Actions to be done on ADFS Server

Add Relying Party Trust

1. Open the Server Manager
2. Open the ADFS Management console (Tools > ADFS Management)
3. Under the Actions pane, click Add Relying Party Trust
4. You’ll now see the welcome page of the Add Relying Party Trust Wizard. Click Start.
5. Select the “Enter data about relying party manually” radio button, then click Next.
6. Enter a “Display Name” of your choice, then click Next
7. Leave the certificate settings here as their defaults and just click Next
8. Select “Enable support for the SAML 2.0 WebSSO protocol”

   For “Relying party SAML2.0 SO service URL”, paste the value of “SP ACS URL” copied earlier. Click Next.

9. For “Relying party trust identifier” paste the value of “SP Entity ID” copied earlier. Then click the “Add” button.
10. Once you see the added entry in the list “Relying party trust identifiers:”, click Next
11. Keep the default setting (Permit everyone) and click Next.
12. The configurations are now complete. Click Next to continue.
13. The relying party trust has now been added. Click Close to proceed to the Edit Claim Rules dialog.
14. Click the Add Rule button.
15. Click Next to create a Send LDAP Attributes as Claims rule.
16. Enter a name for the claim rule, select the Attribute store as Active Directory (this is where the LDAP attributes will be extracted from), then map the LDAP attributes to the outgoing claim type as shown below. Click Finish when you’re done.
17. Now click OK.
18. Now navigate to ADFS Management>Relying Party Trusts, You can see all relying party trusts here. If required, you can edit claims by clicking Edit claim rules. You may also change identifiers by clicking Properties.
19. Navigate to ADFS>Service>Endpoints, and ensure that the following endpoint is enabled /adfs/services/trust/13/usernamemixed

ADFS Certificate Thumbprint

1. Navigate to ADFS > Service > Certificates.
2. Right-click the certificate under Token-signing, then click View Certificate
3. From the Certificate dialog, switch to the Details tab and click Copy to File
4. From the Certificate Export Wizard that opens, click Next
5. Select Base-64 encoded X.509 (.CER) for the format and click Next
6. From File name, specify the path to where the exported certificate should save along with its filename and click Next
7. Review the settings for the exported certificate and click Finish
8. Open the exported certificated file and copy the certificate key