# SSO For ADFS

### Setting up Single Sign-On using Active Directory with ADFS and SAML 2.0 <a href="#setting-up-single-signon-using-active-directory-with-adfs-and-saml-20" id="setting-up-single-signon-using-active-directory-with-adfs-and-saml-20"></a>

#### Step 1 – Adding a Relying Party Trust <a href="#step-1-adding-a-relying-party-trust" id="step-1-adding-a-relying-party-trust"></a>

To set up the ADFS connection with AutoRABIT using a Relying Party Trust (RPT), follow the below steps:

1. Login to the **ADFS Server**.
2. Launch the **ADFS Management Console**.
3. Click on **“Add Relying Party Trust…”** from the **Actions** sidebar on the right.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FiQhToOuF3Xq1x7eiZGye%2Fimage.png?alt=media&#x26;token=49d2d3d5-31de-4a6b-81c7-c29656d22368" alt="" width="488"><figcaption></figcaption></figure>

4. On the **Select Data Source** screen, select the last option: **Enter data about the relying party manually.**

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F27JQGHzvl0kBbeD5Hiav%2Fimage.png?alt=media&#x26;token=51f1bbcf-dbbb-4996-a8e5-4671516a3c50" alt="" width="465"><figcaption></figcaption></figure>

5. On the next screen, enter a **Display name** that you will recognize in the future.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FdIPpejtIOc3ObNsrqQFg%2Fimage.png?alt=media&#x26;token=2b97723c-ea6e-439e-92b7-b378cf82fb8c" alt=""><figcaption></figcaption></figure>

6. On the next screen, select **AD FS profile**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FGecQPFYh2iqOEo6Aq0eb%2Fimage.png?alt=media&#x26;token=c6bacbf4-6e23-40b9-a6dc-4c1c30c8b08e" alt="" width="486"><figcaption></figcaption></figure>

7. On the next screen, leave the defaults.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FuLXcG3KsbPLUprQPqdgp%2Fimage.png?alt=media&#x26;token=217a2904-aedd-4dc9-bf82-02b8fdbd5e29" alt="" width="485"><figcaption></figcaption></figure>

8. On the next screen, check the box labeled: **Enable support for the SAML 2.0 WebSSO protocol**.
9. Enter the service URL. **For ex-** _pg.autorabit.com/saml/SSO_

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FkPUGWmzx9qzzCAEdSndK%2Fimage.png?alt=media&#x26;token=d31567f1-6f2a-42d7-bc15-eec24ddd116b" alt=""><figcaption></figcaption></figure>

10. Click **Next**.
11. On the next screen, add a Relying party trust identifier named **https://pg.autorabit.com/saml/metadata** and click **Add**.
12. On the next screen, leave the defaults.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FiXro1kFTaLk7cpa7tKHh%2Fimage.png?alt=media&#x26;token=627abaa1-4c93-4151-8e73-7ca34f416dde" alt="" width="489"><figcaption></figcaption></figure>

13. On the next screen, select: **Permit all users to access this relying party**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F2XK05KHGLu3RnkkH2kbK%2Fimage.png?alt=media&#x26;token=e81849ec-50ae-43aa-b942-775c22ff5384" alt="" width="485"><figcaption></figcaption></figure>

14. On the next screens, the wizard will display an overview of your settings. Click **Next**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FHWyQv5Cvdi4G6YVi5gFh%2Fimage.png?alt=media&#x26;token=8d079d94-6497-448a-8cee-7f7f3d2d9b5f" alt="" width="479"><figcaption></figcaption></figure>

15. On the final screen use the **Close** button to exit and open the Claim Rules editor.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FZZMPRI2CNF8bb7eAiAid%2Fimage.png?alt=media&#x26;token=d83380d8-a7a4-46c3-89b9-7d4f82ae5a58" alt="" width="488"><figcaption></figcaption></figure>

#### Step 2 – Creating Claim Rules <a href="#step-2-creating-claim-rules" id="step-2-creating-claim-rules"></a>

Once the Relying Party Trust exists, you can create the claim rules and update the Relying Party Trust with minor changes that are not set by the wizard.

1. By default, the Claim Rules editor opens once you created the trust.
2. To create a new rule, click on **Add Rule**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FXr60fvTMHKshRYXsAPn1%2Fimage.png?alt=media&#x26;token=1f293776-9678-4ae8-89a2-fd06330e019a" alt="" width="386"><figcaption></figcaption></figure>

3. Select: **Send LDAP Attributes as Claims rule**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FzevOy3P5SnuTmxFoUpcN%2Fimage.png?alt=media&#x26;token=5b7ada4d-e7fd-4bd7-90c5-5221ae1e98da" alt="" width="485"><figcaption></figcaption></figure>

4.  On the next screen, using **Active Directory** as your attribute store, do the following:

    * From the LDAP Attribute column, select **E-Mail Addresses**.
    * From the Outgoing Claim Type, select **E-Mail Address**.

    <figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FyOaNZN4EWzQgmgsfdKMC%2Fimage.png?alt=media&#x26;token=279de5f4-8ede-4e19-8a11-4381b8696a92" alt="" width="378"><figcaption></figcaption></figure>
5. Click **OK** to save the new rule.
6. Create another new rule by clicking **Add Rule**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F3l5IckmAdzZhWa2y8zN0%2Fimage.png?alt=media&#x26;token=8abf1666-e8c0-416e-ab10-c53ec03f31e8" alt="" width="386"><figcaption></figcaption></figure>

7. Select: **Transform an Incoming Claim as the template**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F5OJ0fvxhsfpOLOkHBmBV%2Fimage.png?alt=media&#x26;token=15e56167-0141-4e78-b9ca-da7fbb4bf5ae" alt="" width="437"><figcaption></figcaption></figure>

8.  On the next screen:

    * Select **E-mail Address** as the Incoming Claim Type.
    * For Outgoing Claim Type, select **Name ID**.
    * For Outgoing Name ID Format, select **Email**.
    * Leave the rule to the default of **Pass through all claim values**.

    <figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FNmWxLBQZDdhyuHdCoPru%2Fimage.png?alt=media&#x26;token=cd7472bf-f9c6-464b-94b0-35e5157de85a" alt="" width="377"><figcaption></figcaption></figure>
9. Finally, click **OK** to create the claim rule, and then **OK** again to finish creating rules.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FWaCiA3X6VaHBaEjzYutR%2Fimage.png?alt=media&#x26;token=1cf6a965-0454-4b66-9ad4-f6d6d2688507" alt="" width="563"><figcaption></figcaption></figure>

10. Under **ADFS Management Console**, navigate to **Services > Endpoints** and find the URL to download the metadata XML file. See the screenshot attached.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FR0Fiw3lsJJ76yIahAKYr%2Fimage.png?alt=media&#x26;token=85059364-582c-4a10-b271-9bf4e53084aa" alt="" width="563"><figcaption></figcaption></figure>

#### Step 3: Configuring SSO in AutoRABIT <a href="#step-3-configuring-sso-in-autorabit" id="step-3-configuring-sso-in-autorabit"></a>

Now that your ADFS SSO implementation is set up, you’ll need to follow just a few more steps to configure SSO in your AutoRABIT account.

1. Log in to your AutoRABIT account.
2. Hover your mouse over the **Admin** module and select the option: **My Account**
3. On the **My Account** page, go to the **SSO Configuration** section.
4. Browse for the metadata XML file that you have downloaded previously in your local machine and upload them.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FdY7NVuPa0ouiaQJxTqAs%2Fimage.png?alt=media&#x26;token=875f9ef2-a028-4a2e-b94a-bb0c1d535b7f" alt=""><figcaption></figcaption></figure>

5. Sign out from your AutoRABIT account.
6. Go to the AutoRABIT login page. This time you need to login via SSO, so, therefore, click on the option: **Single Sign On.**

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FR0JULDwqCs6AsxX4vlFA%2Fimage.png?alt=media&#x26;token=0bf624e0-6ac5-46f6-944e-e0187308b9b9" alt=""><figcaption></figcaption></figure>

7. Enter the domain name and click on **Go**.
8. Next, you will be redirected to your custom domain URL where you need to enter the **username** and **password** to access the AutoRABIT.
