Sign in

Set up an AD FS server and configure SSO

    Updated:
    1 min read

    Section 1: Install IIS Web Server

    NOTE: If IIS is already installed on your Windows Server, skip to Section 2.

    Steps

    • Open the Server Manager application on Windows Server.
    • In Server Manager, go to Manage, and then click Add Roles and Features.
    Image

    • The Add Roles And Features wizard opens.
    • Click Next.
    • Select  Role-based or feature-based installation and then click Next.
    Image

    • Click Select a server from the server pool and then select the server on which to install IIS Web Server. Click Next.
    Image

    • Select Web Server (IIS) from Server Roles and then click Next.
    Image

    • In the Add Roles and Features Wizard, select Install management tools (if applicable) and then click Add features.
    • Select Web Server (IIS) and click Next.
    • On the Select Features page, select .NET Framework 3.5 Features and then click Next.
    Image

    • On next page, click Next.
    • On next page (Select Role Services), keep the defaults and click Next.
    • Select Restart the destination server automatically if required.
    • Click Install.
    • Close the window when the installation is complete.


    Section 2: Install Active Directory Domain Services (AD DS)

    NOTE: If AD DS is already installed on the Windows Server, skip to Section 3.

    Steps

    • Open the Server Manager application on Windows Server.
    • In Server Manager, go to Manage, and then click Add Roles and Features. 
    Image

      • The Add Roles And Features wizard opens.
    • Click Next.
    • Select  Role-based or feature-based installation and then click Next.
    Image

    • Click Select a server from the server pool and then select the server on which to install IIS Web Server. Click Next.
    Image

    • On the Select Server Roles page, select Active Directory Domain Services and then click Next.
    Image

    • In the Add Roles and Features Wizard, select Include Management tools (if applicable) and then click Add Features.
    Image

    • Select AD DS and then click Next.
    • On the Select Features page, select .NET Framework 3.5 Features and then click Next.
    • On next page, click Next.
    • On last page, select Restart the destination server automatically if required.
    • Click Install.
    • Click Close when the installation is complete.
    • In the Notifications section of the Server Manager page, in the Post Deployment Configuration... notification, click Promote this server to a domain controller. 
    Image

      • The Deployment Configuration page opens.
    • In the Windows Security pop-up panel, enter the Username and Password of the local machine and then click OK.
    Image

    • On the Deployment Configuration page, select Add a new forest, provide the Root domain name (example: tenfold.local), and then click Next. 
    Image

      • The Domain Controller Options page opens.
    • Provide and confirm the password for Directory Service Restore mode (DSRM), and make sure the configuration is same as shown below:
    Image

    • On the DNS Options page, click Next.
    Image

    • On the Additional Options page, enter the NetBIOS domain name in the field provided and then click Next.
    Image

    • On the Paths page, provide the required paths as shown below, and then click Next.
    Image

    • Review all the options on the Review Options page and then click Next.
    • On the Prerequisites Check page, validate the prerequisites and then click Install.
    Image

    • The Installation page shows the installation progress. Click Close when the installation is complete.


    Section 3: Install Active Directory Federation Services (AD FS)

    Steps

    • Open the Server Manager application on Windows Server.
    • In Server Manager, go to Manage, and then click Add Roles and Features. 
    Image

      • The Add Roles And Features wizard opens.
    • Click Next.
    • Select  Role-based or feature-based installation and then click Next.
    Image

    • Click Select a server from the server pool and then select the server on which to install IIS Web Server. Click Next.
    Image

    • On the Select server roles page, select Active Directory Federation Services and then click Next.
    Image

    • Click Features and select .NET Framework 3.5 Features, then click Next.
    Image

    • On the next page, click Next.
    • On the Confirmation page, select Restart the destination server automatically if required, click Yes to confirm, and then click Install.
    Image

    • Click Close when the installation is complete.
    • Go to Server Manager and navigate to Tools > Internet Information Services (IIS) Manager. 
      • NOTE: You will see a notification Post-Deployment Configuration for AD FS. Ignore this notification for now. You must first create a SSL Certificate first to use with AD FS Server.
    Image

    • From the Home page of IIS Manager, click Server Certificates.
    Image

    • In the Actions pane, click Create Self-Signed Certificate.
    Image

    • On the Create Self-Signed Certificate tab, enter a user-friendly name in the Specify a friendly name for the certificate field, then select Personal. Click OK. 
    Image

      • The SSL Certificate is now created.
    • Go back to Server Manager. In the notification for Post-Deployment Configuration for AD FS, click Configure the federation service on this server. 
    Image

      • The Active Directory Federation Services Configuration Wizard opens.
    • Select Create the first federation server in a federation server farm and then click Next.
    Image

    • On the Connect to AD DS page, select the account to perform the Federation Service configuration, and then click Next.
    Image

    • On the Specify Service Properties page, select the SSL Certificate, Federation Service Name, and  Federation Service Display Name. (Example for Federation Service Display Name: Tenfold AD FS Server)
    Image

    • On the Specify Service Account page, select the Use an existing domain user account or group Managed Service Account option and click OK.
    Image

    • Enter the Account Password and click Next.
    Image

    • On the Specify Database page, select Create a database on this server using Windows Internal Database and then click Next.
    • On next page (Review Options), review all the options and click Next.
    • On next page (Prerequisite check), validate the prerequisites and then click Configure.
    Image

    • The next page shows the installation progress. Click Close when the installation is complete.


    Section 4: Add relying party (Tenfold) to AD FS

    Steps

    • Using the Windows server browser, go to https://dashboard.tenfold.com/features and click the link for the Single Sign-On feature. Click Download Tenfold Metadata. 
      • The Tenfold Metadata.xml downloads.
    Image

    • In Windows Server Manager, navigate to Tools > AD FS Management.
    Image

    • The AD FS panel opens. In the Actions pane, click Add Relying Party Trust.
    Image

    • On the Welcome page of the Add Relying Party Trust Wizard, select the Claims Aware option and then click Start.
    Image

    • On the Select Data Source page, select Import data about the relying party from the file, and browse to the location of the xml file downloaded in Step 1.
    Image

    • On the Specify Display Name page, enter the Display name and click Next.
    Image

    • On the Multi-factor Authentication page, select I do not want to configure multi-factor authentication settings for this relying party trust at this time and then click Next.
    Image

    • On the Choose Issuance Authorization Rules page, select Permit all users to access this relying party and then click Next.
    Image

    • On the Ready to Add Trust page, click Next.
    • On the Finish page, select Open the Edit Claim Rules dialog for this relying party trust when the wizard closes and then click Close. 
    Image

      • The Edit Claims Rules for Tenfold page opens.
    • Click Add Rule. 
    Image

      • The Add Transform Claim Rule Wizard opens.
    • On the Select Rule Template page, select Send LDAP Attributes as Claims and click Next.
    Image

    • On the Configure Rule page, enter the Claim rule name, select Active Directory as the Attribute Store, and add mappings similar to the image shown below. Click OK.
    Image

    • Click Add Rule. 
    Image

      • The Add Transform Claim Rule Wizard opens.
    • On Select Rule Template page, select Transform an Incoming Claim and click Next. 
    Image

      • The Configure Rule page opens.
    • Configure the options as shown below and then click Finish.
    Image

    • On the page that loads, click Apply and then OK. 
      • Note: Because the user's email address is used for the Name ID, make sure the user has this attribute. This completes the AD FS configuration.


    Section 5: Configure Tenfold SSO

    Steps

    • Download the AD FS metadata using this URL: 
      • https://<adfs_server_domain_name>/FederationMetadata/2007-06/FederationMetadata.xml
    • Complete the information in the Single Sign-On feature. 
      • NOTE: In most scenarios that do not use AD FS, Single Sign-On works by simply uploading this metadata to the Tenfold Single Sign-On settings. However, Tenfold is not able to parse the metadata correctly, so it is necessary to extract the following three parameters from the metadata and manually add them: Identity Provider Entity ID, Identity Provider entry endpoint, Identity provider public certificate. 
    Image

    javascript:
    * <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" ID="_b207a111-f512-4fb1-b97f-155ba7849742" entityID="http://EC2AMAZ-5OVH26R.adfs.local/adfs/services/trust">
    javascript:
    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://ec2amaz-5ovh26r.adfs.local/adfs/ls/" />
        • Identity provider public certificate
          • The signing certificate inside the IDPSSODescriptor element.


    Missing Something?

    Check out our Developer Center for more in-depth documentation. Please share your documentation feedback with us using the feedback button. We'd be happy to hear from you.