Setting Up ADFS for Single Sign-On (SSO)

Table of contents

1. Introduction
2. Prerequisites
3. SSO Configuration Steps
4. User Provisioning

Introduction

Single Sign-On (SSO) makes accessing your applications easier and more secure by letting users log in just once to access all authorized tools. Active Directory Federation Services (ADFS) is a popular solution for implementing SSO within an organization's infrastructure. 

This guide provides a step-by-step walkthrough for configuring ADFS to enable SSO with the Pixelz Platform.

Notice: 

• Active Directory Federation Services (AD FS) doesn't natively support the System for Cross-domain Identity Management (SCIM) protocol. 
• SCIM is typically used for automating the exchange of user identity information between identity providers and service providers.

Prerequisites

Before starting, ensure you have the following requirements in place:

• Windows Server with ADFS role  installed & configured

• Active Directory Domain Services (AD) configured.

• SSL certificate for ADFS service.

SSO Configuration Step-by-step

1. Sign up users & configure domain on Pixelz Platform

• In the Pixelz Platform, navigate to Account Settings > SSO Login.

• Enter the required credentials, then upload the SAML Metadata.

SSO Login Setting on Pixelz Platform

The SAML Metadata can be downloaded from your ADFS server after configuring the 2nd step below.

(URL to download SAML Metadata: https://{your adfs server URL}/FederationMetadata/2007-06/FederationMetadata.xml)

2. Add Relying Party Trust

• In the ADFS Management Console, navigate to ADFS > Trust Relationships > Relying Party Trusts.
• Right-click and select Add Relying Party Trust.
• Choose Claims aware and click Start.

Add Relying Party Trust Wizard

Add Relying Party Trust Wizard

• Enter the relying party trust display name (e.g., Pixelz Relying Party).

Relying Party Trust Information

• (Optional) Choose a token encryption certificate.

Relying Party Trust Certificate

• Enter the relying party trust identifier.

Enable SAML 2.0 service URL

• Click Next to configure identifiers

Configure Relying party trust identifier

• After entering the trust identifier, click Add then Next to continue configure Access Control Policy.

Configure ACP

• Select Permit all users to access this relying party (or configure as needed).
• Complete the wizard to add the relying party trust.

Complete configure relying party trust

3. Configure Claims Rules

• Right-click the newly added relying party trust and select Edit Claim Rules.

Configure claims rules

• Click Add Rule and select Send LDAP Attributes as Claims.

Configure claims rules

• Configure the rule to map LDAP attributes to outgoing claim types required by the relying party (Pixelz) application, then click OK to save the rule.

Configure claims rules

4. Test SSO

• Ensure that the relying party application is configured to use ADFS for authentication.
• Access the application and verify that users are redirected to the ADFS login page.

• Log in with valid credentials from the AD DS.

• Verify that users are authenticated and redirected back to the application without needing to log in again.

User provisioning

ADFS doesn't natively support the System for Cross-domain Identity Management (SCIM) protocol, so users have to create new Pixelz’s contact manually on Pixelz Platform with email matches with users in ADFS or set up SCIM by using third-party tools. 

Manual Setup on Pixelz:

• Log in to Pixelz at https://login.pixelz.com, then navigate to Users.

• Invite new user(s) with email using in ADFS: