This article provides instructions on setting up AD FS (Active Directory Federation Services) for SSO. If you're not using AD FS, you'll need to contact your identity provider for specific instructions.
IMPORTANT NOTE: Single sign-on (SSO) authentication is available on the Enterprise edition of Perspective 5.1 or later.
Before proceeding, please review the information and prerequisites in the What is SSO and How Do I Get It? article.
Note: AD FS must be configured to accept SAML requests prior to completing these steps.
-
Remotely connect to your AD FS server.
-
Open Server Manager.
-
Click Tools in the top-right of the screen, then select AD FS Management.
-
In the pane to the left, click AD FS > Trust Relationships.
-
Right-click Relying Party Trusts.
-
Click Add Relying Party Trust… to open the wizard.
-
Click Start.
-
On the Select Data Source page, select Import data about the relying party published online or on a location network.
-
Enter the URL for your metadata in the Federation metadata address (host name or URL) field:
-
Perspective:
https://ACME.MyIncidents.com/PerspectiveServices/SAML/Metadata/ACMEMetadata.xml -
Integration Service:
https://ACME.MyIncidents.com/IntegrationServices/SAML/Metadata/ACMEMetadata.xml
-
Click Next.
-
On the Specify Display Name page, enter a descriptive name in the Display Name field.
-
Enter any notes, as needed, in the Notes field.
-
Click Next.
-
Complete the remainder of the steps in the wizard. Once complete, the window will close and the Edit Claim Rules will open. If it doesn’t open automatically, select the trust from the Relying Party Trusts pane, then click Edit Claim Rules...
-
Click Add Rule… from the Issuance Transform Rules tab in the Edit Claim Rules window.
-
Select Transform an Incoming Claim from the Claim rule template dropdown menu on the rule wizard.
-
Click Next.
-
Enter a name for the rule in the Claim rule name field.
-
Select a claim type from the Incoming claim type dropdown menu.
-
Enter Name ID in the Outgoing claim type field.
-
Select a name format from the Outgoing name ID format dropdown menu.
-
Click Finish.
-
Double-click the trust you just created, then click the Advanced tab.
-
Select SHA-1 from the Secure hash algorithm dropdown menu.
-
Click OK.
Troubleshooting
During the Federation Passive Request, Perspective may send the AssertionConsumerService URL with a capitalized P in the word "Perspective" (i.e. https://<PerspectiveServicesURL>/Perspective/SAML/AssertionConsumerService.aspx), causing the following error message to display:
To resolve this issue, you must edit the Relying Part Trust configured for Perspective by completing the following steps:
- Click the Endpoints tab.
- Select the SAML Assertion Consumer.
- Open the Edit Endpoint window.
- Edit the URL in the Trusted URL field to show the word "perspective" with a capital P (i.e. Perspective).
- Click OK.
See also: