# Active Directory Federation Services (AD FS)

Steps not yet verified in the identity provider's current admin console.

Recommended protocol: SAML 2.0.

## SAML 2.0

### Connect AD FS with SAML 2.0

1. In Server Manager choose Tools \> AD FS Management, then under Actions click Add Relying Party Trust.
2. On Welcome choose Claims aware and click Start.
3. Either import the KeenAuth metadata (**SP metadata URL**, use a fully qualified host name) or choose Enter data about the relying party manually.
4. For manual entry: on Specify Display Name enter a name, on Configure Certificate leave token encryption empty and click Next, on Configure URL enable support for the SAML 2.0 WebSSO protocol with service URL **ACS URL**, and on Configure Identifiers add **SP entity ID**.
5. Choose an access control policy and finish; in Edit Claim Issuance Policy add the rule template Send LDAP Attributes as Claims.
6. Add a Send LDAP Attributes as Claims rule with attribute store Active Directory that maps the LDAP attributes E-Mail-Addresses, Given-Name and Surname to the outgoing claim types E-Mail Address, Given Name and Surname; then add a Transform an Incoming Claim rule that turns E-Mail Address into the outgoing claim type Name ID.
7. AD FS Management has no metadata export: download the federation metadata from `https://<your AD FS host>/FederationMetadata/2007-06/FederationMetadata.xml`, upload it in KeenAuth, then run the connection test.

Values in bold are shown on the connection's page in the Admin Portal, where this guide has them filled in.