AD FS Configuration for Acubiz SSO

Introduction

This document describes the configuration of Acubiz EMS as a Relying Party Trust in Microsoft Active Directory Federation Services (AD FS). The setup ensures that the company's users can access Acubiz EMS via Single Sign-On (SSO).

Contents of this article:

• 1. Sending Federation Metadata to Acubiz
• 2. Configuration of Acubiz EMS as Relying Party Trust
• 3. Test the SSO connection

1. Sending Federation Metadata to Acubiz

First, the company's FederationMetadata.xml file or corresponding URL must be sent to Acubiz Support.

Procedure for extracting Federation Metadata:

1. Open a browser and retrieve the FederationMetadata.xml file directly from the company's AD FS platform.

   URL structure:

   https://adfs.[companydomain].com/federationmetadata/2007-06/federationmetadata.xml

2. Troubleshooting if access is denied:

   If the metadata file cannot be accessed, verify that the Metadata endpoint is enabled in AD FS:

   • Open AD FS Management.

   • Navigate to AD FS > Service > Endpoints.

   • Find the Metadata section and confirm that the endpoint is set to Enabled.

Note: Instead of manually sending the XML file, you can send the direct link (URL) to the file, provided it is publicly accessible.

2. Configuration of Acubiz EMS as Relying Party Trust

General configuration

1. Open AD FS Management → Add Relying Party Trust
   
   Click the [Start] button in the window
    

2. Select “Import data about the relying party published online or on local network” and
   enter the following URL in the address field:

   https://auth.acubiz.com/federationmetadata/2007-06/federationmetadata.xml

   
   Click the [Next] button
   
    

3. Enter “Acubiz” as the Display name
   
   Click the [Next] button
    
4. Ensure that “I do not want to configure…” is selected:
   
   Click the [Next] button
    
5. Ensure that “Permit all users to access this relying party” is selected:
   
   Click the [Next] button
   If you wish to limit access to Acubiz EMS for specific users, this can be configured later in the Claim Rule view under “Issuance Authorization Rules”.
   
   Click the [Next] button
   
   Click the [Close] button

Configuration of Claim Rules

This section describes the Claim Rules required to connect to Acubiz:

Click the [Add Rule…] button

Set up AD Attributes

Select “Send LDAP Attributes as Claims”:

Click the [Next] button.

Configure LDAP attributes

Configure the LDAP Attribute store to send Claim Types as follows:

 
The Claim type “name” is required and must contain the user’s email address!

Click the [OK] button

3. Test the SSO connection

Now Test the SSO connection to Acubiz