Skip to main content
All CollectionsCustomization
Setting up SSO using Active Directory Federation Services
Setting up SSO using Active Directory Federation Services

You can set up SSO using ADFS and SAML claims by following these steps.

Stephen Chang avatar
Written by Stephen Chang
Updated over 3 years ago

Note: We provide basic support for SSO through these articles, but we are unable to offer any further assistance regarding the initial setup on your end. If there are errors, debug logs will need to be provided before we are able to assist.

Note: To view supported SAML claims, click here.

IMPORTANT: Please use Google Chrome and not Internet Explorer, as Internet Explorer may incorrectly present a security warning and you may not be able to save the page.

Configuring SkyPrep with ADFS is a multi-step process, and this article will serve to walk you through the procedure.

First, enable ADFS on your Windows Server.

Next, open the AD FS Management console.

1.png

Next, click on Add Relying Party Trust…

2.png

This should open the wizard. Click the Start button.

3.png

Select Enter data about the relying party manually.

4.png

Enter https://[your_skyprep_domain]/saml/consume as the display name

5.png

Select AD FS profile

6.png

Check Enable support for the SAML 2.0 WebSSO protocol and enter “https://[your_skyprep_domain]/saml/consume”. Then click Next.

7.png

Add “https://[your_skyprep_domain]/saml/consume” in the Relying party trust identifiers.

8.png

Select I do not want to configure multi-factor authentication settings for this relying party trust at this time.

9.png

Select Permit all users to access this relying party.

10.png

In the Edit Claim Rules section, add the settings so they look like this:

You can add additional attributes to the SAML Claims.

These can be mapped as the following in the Outgoing Claim Type column:

User.EmailNotifications
User.Email
User.FirstName
User.LastName
User.Company
User.Title
User.Address
User.Address2
User.State
User.Zip
User.Cell
User.Phone
User.WorkPhone
User.Ssn
User.DateOfBirth
User.UserIdentifier
User.Gender
User.Ca0
User.Ca1
User.Ca2
User.Ca3
User.Ca4
User.Ca5
User.Ca6
User.Ca7
User.Ca8
User.Ca9
User.Ca10

You can also fix attributes to a specific value. For example, to set User.EmailNotifications to true, you can Edit Claim Rules, click Add Rule, use Send Claims using a Custom Rule and set the rule like such:

  • Next, go to the SAML configuration page at https://[your_skyprep_domain]/admin/program/saml and paste the text copied above (Ctrl-V) the into the idP Metadata (XML) field.

  • Optionally, enable Automatically Create / Add Users (JIT) and Automatically Add Users to Existing Groups.

To test the integration, visit


Troubleshooting

If your setup was previously working and suddenly isn’t, please double check the idP XML manifest file and update it in the integration settings listed in your account.

For example, whenever you update the SSL certificate on your ADFS server, make sure to update the metadata XML on the LMS as well. This usually happens once a year or so.

Did this answer your question?