Single Sign-On: First time configuration with ADFS as a SAML Identity Provider (IdP)

Introduction:

This is an example of setting up Barco SAML-based Single Sign-On (SSO) with ADFS as your Identity Provider (IdP).

Instructions:

1. Locate the metadata export URL for ADFS
2. Download FederationMetadata.xml file
3. Start the Single Sign-On configuration on BMS
4. Complete configuration on your IdP (ADFS)
   1. Create Claims Provider Trust
   2. Create a Rule to Send Claims Using a Custom Rule
   3. Verify SAML response signature
   4. Message is signed with expected signature algorithm

1. Locate the metadata export URL for ADFS:

1. Log in to the ADFS server and open the management console.
2. In the ADFS folder, expand Service and click Endpoints.
3. Locate the FederationMetadata.xml file.

2. Download FederationMetadata.xml file:

1. Open the web-browser on your laptop and enter the URL (e.g.:https://localhost/FederationMetadata/2007-06/FederationMetadata.xml) to navigate to the FederationMedata.xml file on ADFS server.
2. Download the FederationMedata.xml file to your laptop. This file will be used for BMS.

3. Start the Single Sign-On configuration on BMS:

1. Navigate to the Single Sign-On settings page on Barco Management Suite.
2. Select protocol as SAML v2.0.
3. For your metadata, select the FederationMedata.xml file (downloaded in the procedure above) and click Upload.
4. After the metadata has been uploaded, download the Barco metadata file by clicking the download button.

4. Complete configuration on your IdP (ADFS):

In this step, you need to use the Barco metadata file obtained from BMS to complete configuring the application on your IdP.

1. Create Claims Provider Trust
2. Create a Rule to Send Claims Using a Custom Rule
3. Verify SAML response signature
4. Message is signed with expected signature algorithm

Create Claims Provider Trust:

To add a new claims provider trust, using the ADFS Management snap-in, by automatically importing Barco SAML RP policy metadata.

1. In Server Manager, click Tools and then select ADFS Management.
    
2. Click Relying Party Trusts.
   
   
    
3. Under Actions, click Add Relying Party Trust...
   
   
    
4. Click Welcome and then click Start.
   
   
    
5. Click Select Data Source and then click Import data about the relying party from a file. In Federation metadata file location, browse Barco metadata file (downloaded from BMS in above step 4 of the procedure Start the Single Sign-on configuration on BMS) and then click Next.
   
   
    
6. Click Specify Display Name and enter the Display name as Barco (remember Display name for later use) and then click Next.
   
   
    
7. Click Choose Access Control Policy and then click Next.
   
   
    
8. Click Next.
    
9. Click Next.
    
10. Leave the default settings and click Close.

Create a Rule to Send Claims Using a Custom Rule:

1. Select a Barco Claim Provider Trust and click Edit Claim Issuance Policy.
   
   
    
2. Click Add Rule.
   
   
    
3. Select Send LDAP Attributes as Claims and click Next.
   
   
    
4. Configure claims rule.
   
   
    
   Note: E-Mail-Addresses must be mapped with assertionSubjectName as outgoing claim type.
   
   If above Email claim does not work, instead of E-Mail-Addresses map User-Principal-Name with assertionSubjectName.
   
   
    
5. Click Finish

Verify SAML response signature:

Get-ADFSRelyingPartyTrust

and make sure SamlResponseSignature set as MessageAndAssertion received in the output result.

Set-AdfsRelyingPartyTrust -TargetName "Barco" -SamlResponseSignature MessageAndAssertion

Message is signed with expected signature algorithm:

1. Right-click on Barco and then click Properties.
   
   
    
2. Click Advanced tab and select the algorithm you want to keep (SHA-256 is more secure).
   
   
    
3. Make sure the same value is set in the Signature algorithm on BMS.
   
   
    
4. Click Apply and then click OK.