ADFS SSO Configuration

This basic guide shows how to configure ADFS with uStudio Podcast. Please note that this guide may not cover everything your organization may want to set up.

PREREQUISITE

uStudio needs a sign-on URL and certificate.

Step 1: Adding a Relying Party Trust

1. Go to ADFS Management.
2. Select “Relying Party Trusts” within the tree folder of ADFS.
3. Then right-click and select “Add Relying Party Trust…”.

Step 2: Basic ADFS Configuration

1. Click “Start” at the bottom to navigate to “Select Data Source”.
2. Import uStudio’s metadata or enter information manually. This guide will assume fields are to be entered manually.
3. Click “Next” at the bottom to navigate to “Specify Display Name”.
4. Enter a display name (e.g. uStudio).
5. Click “Next” at the bottom to navigate to “Choose Profile”.
6. Ensure “ADFS profile” is selected for SAML2.0 protocol.
7. Click “Next” at the bottom to navigate to “Configure Certificate”.
8. Import uStudio’s certificate.
9. Click “Next” at the bottom to navigate to “Configure URL”.
10. Check “Enable support for the SAML 2.0 WebSSO protocol”.
11. Set “Relying party SAML 2.0 SSO service URL” with https://ustudioinc.auth0.com/login/callback?connection=prod-companycode-podcast-sso
12. Note: companycode is provided to you by uStudio.
13. Click “Next” at the bottom to navigate to “Configure Identifies”.
14. Set “Relying party trust identifier” with urn:auth0:ustudioinc:prod-companycode-podcast-sso
15. Click “Add”.
16. Click “Next” at the bottom to navigate to “Configure Multi-factor Authentication Now?”.
17. Select “I do not want to configure multi-factor…”. Note: MFA enablement is up to you.
18. Click “Next” at the bottom to navigate to “Choose Issuance Authorization Rules”.
19. Select “Permit all users…”. Note: You can deny all users if you wish to use a group or further restrictions.
20. Click “Next” at the bottom to navigate to “Ready to Add Trust”.
21. Review settings.
22. Click “Next” at the bottom to navigate to “Finish”.
23. Ensure the checkbox next to “Open the Edit…”.
24. Click “Close”.

Step 3: Creating Claim Rules

Using the table below, you’ll want to repeat these steps to map out attributes.

Requirement	Rule	LDAP Attribute	Outgoing Attribute
Required	User ID	E-Mail-Addresses or Unique ID	user_id
Optional	Email	E-Mail-Addresses	email
Optional	First Name	Given-Name	given_name
Optional	Last Name	Surname	family_name
Optional	Groups	*	groupName

*Note: According to this Microsoft guide, there is a template called “Send Group Membership as a Claim” within the drop-down of “Claim rule template”. groupName is a multivalued attribute with unique names or ids for groups.

1. Under “Issuance Transform Rules”, click “Add Rule…”.
2. Select “Send LDAP Attributes as Claims” within the drop-down of “Claim rule template”.
3. Click “Next” at the bottom.
4. Set “Claim rule name” to (e.g. “ LDAP Email”).
5. Set “Attribute store” to “Active Directory”.
6. Set “LDAP Attribute…” to “E-Mail-Addresses”.
7. Set “Outgoing Claim…” to “email” by typing in.
8. Click “OK” to save the rule and continue.
9. Once you’re done mapping attributes, click “OK” in the pane of “Edit Claim Rules for…” (first image).

Step 4: Advanced Settings

To access these settings, select “Properties” from the “Actions” sidebar on the right while you have “Relying Party Trust” selected.

1. Select “Advanced” tab.
2. Set “Secure hash algorithm” to “SHA-256”.
3. Select “Endpoints” tab.
4. Click “add SAML” to add this endpoint.
5. Set “Endpoint type” to “SAML Logout”.
6. Set “Binding” to “POST”
7. Set “Trusted URL” to your ADFS.
8. Note: You may need to configure something similar for login as a redirect.

Step 5: Test SSO connection…

Test with [e-mail]

Credits

This guide is based off of LiquidPlanner’s ADFS SSO configuration guide.