Active Directory Federation Services (AD FS)

Steps not yet verified in the identity provider's current admin console.

Recommended protocol: SAML 2.0.

SAML 2.0

This guide is not available in your language yet; it is shown in en.

In Server Manager choose Tools > AD FS Management, then under Actions click Add Relying Party Trust.
On Welcome choose Claims aware and click Start.
Either import the KeenAuth metadata (SP metadata URL, use a fully qualified host name) or choose Enter data about the relying party manually.
For manual entry: on Specify Display Name enter a name, on Configure Certificate leave token encryption empty and click Next, on Configure URL enable support for the SAML 2.0 WebSSO protocol with service URL ACS URL, and on Configure Identifiers add SP entity ID.
Choose an access control policy and finish; in Edit Claim Issuance Policy add the rule template Send LDAP Attributes as Claims.
Add a Send LDAP Attributes as Claims rule with attribute store Active Directory that maps the LDAP attributes E-Mail-Addresses, Given-Name and Surname to the outgoing claim types E-Mail Address, Given Name and Surname; then add a Transform an Incoming Claim rule that turns E-Mail Address into the outgoing claim type Name ID.
AD FS Management has no metadata export: download the federation metadata from https://<your AD FS host>/FederationMetadata/2007-06/FederationMetadata.xml, upload it in KeenAuth, then run the connection test.

Values in bold are shown on the connection's page in the Admin Portal, where this guide has them filled in.