SSO with Active Directory Federation Services (ADFS)



SSO will allow you to use your existing Active Directory userbase as user management for your Jostle platform.  In other words, Jostle will not create usernames and passwords for you in the application, but instead when your users access Jostle, Jostle will pass back the authentication request to your AD domain.  This is done through an AD add-on called Active Directory Federation Services (ADFS).

The main benefits are:

  • You get to manage only one set of user credentials across your organization via AD.
  • Once you log into one SSO application your authentication stays valid for the others.

It does not inherently:

  • Allow password-less logins.

 Steps to get ADFS/SSO up and running

1. Set up a public-facing domain name for the ADFS server

Communication between Jostle and ADFS occurs over HTTPS, therefore you will need a domain or sub domain to use for your ADFS server, with a published DNS record (ie Internet routable).  We should be able to resolve the address from our office (usually loads the default IIS server page).  Access can be restricted to the HTTPS default port (443), but for testing purposes ICMP and port 80 should be allowed through as well.

2. A certificate from a well-known certificate authority

The domain used in step 1 needs to be secured via SSL.  It is best to use any SSL provider that is by default part of most browsers trusted certificate authority list.  Here are a few companies that are by default included:


3. General ADFS set up

If you are going to use ADFS, you have to install and configure ADFS 2.0. The installation and configuration is specific to your environment including configuration related to your Active Directory, the details of which are beyond the scope of this article.  As part of this set up, you will have to get an SSL certificate (if you don’t already have one that you plan to use) since ADFS will act as the identity provider and the protocol will be using HTTPS.  Once you have done the general installation and set up, you can use the instructions below to integrate with Jostle.

How to install ADFS

Install the ADFS 2.0 Software (Microsoft)

External versus Internal access

Jostle and ADFS communicate over HTTPS, but all the user authentication occurs between your users and ADFS.  This gives you the option of controlling whether you allow users to authenticate from outside your network or not.  This is controlled through ADFS, and requires no changes on Jostle's side.

3a) Configuring ADFS for Jostle: Configuring the relying party (Deploy certificates)

  1. Save the Jostle public key certificate below (everything including ---- BEGIN CERTIFCATE ---- and ---- END CERTIFICATE ----) into a file called jostle.cer somewhere in the filesystem 
  2. Start ADFS Management application 
  3. In the Actions menu, select “Add Relying Party Trust” which will bring up the “Add Relying Party Trust Wizard” 
  4. Select "Claims aware" in the Welcome screen and then Click ‘Start’ 
  5. Select “Enter data about the relying party manual” and hit ‘Next’ 
  6. Enter “Jostle” in Display name and hit ‘Next’ 
  7. In the Configure Certificate step, hit ‘Browse’ and choose jostle.cer, then hit ‘Next’ 
  8. In the Configure URL step, select ‘Enable support for the SAML 2.0 WebSSO Protocol’ and enter the following into the ‘Relying party SAML 2.0 SSO service URL':
  9. In the Configure Identifiers step, in the ‘Relying party trust identifier’ field enter:  And then hit ‘Add’ and then ‘Next’
  10. In the Choose Issuance Authorization Rules step, choose ‘Permit everyone’ and the hit ‘Next’ 
  11. In the Ready to Add Trust step, hit ‘Next’ 
  12. In the Finish step, check the ‘Open the Edit Claim Rules dialog for this relying party when this wizard closes’ and hit ‘Close’ 
  13. When the Edit Claims Rules dialog comes up, select ‘Issuance Transform Rules’ tab and hit ‘Add Rule’ 
  14. In Choose Rule Type step, under Claim rule template select ‘Send LDAP attributes as Claims’ and hit ‘Next’ 
  15. In the Configure Claim Rule step, create a mapping as follows:
    • Claim rule name: Email Addresses As Email
    • Attribute Store: Active Directory
    • Mapping of LDAP attribute to outgoing claim types: E-Mail-Addresses to E-Mail Address
  16. Create another new rule by clicking 'Add Rule', under Claim rule template select ‘Transform an Incoming Claim’ and hit ‘Next’. 
  17. In the Configure Claim Rule step, create a mapping as follows:
    • Claim rule name: Email Address as Name ID
    • Incoming claim type: E-Mail Address
    • Outgoing claim type: Name ID
    • Outgoing name ID format: Email
    • Select 'Pass through all claim values' 
    • Note: this rule should be Order 2 and the previous rule is Order 1
  18. In the ADFS Management application, open the AD FS folder, then open Trust Relationship folder, then select Relying Part Trust’ and then double click on ‘Jostle’ in the Relying Party Trusts list. 
  19. Select Signature tab and then hit ‘Add’, then select ‘jostle.cer’ and then hit ‘Open’, the ‘Apply’ and ‘OK” (if desired, for the Encryption tab leave it blank or add 'jostle.cer').
  20. Select Advanced tab and change the secure hash algorithm to SHA-256.
  21. You can optionally setup Single Sign Out. Right click Jostle under the list of Relying Party Trusts and go to Properties. Under the Endpoints tab, click Add SAML, set the Endpoint type to SAML Logout. Binding should be set to Post and the fill in the Trusted URL as follows:  Hit 'OK' then 'Apply'.

Public Key




3b) Set the NotBeforeSkew to allow for time drift between your server and ours:

Open Windows PowerShell via the Start Menu, and run these commands:

ADFS 2.0

1) Add-PSSnapin Microsoft.Adfs.PowerShell

#Load up the ADFS PowerShell plug in
2) Get-ADFSRelyingPartyTrust –identifier “”

#Just to see what the values were
3) Set-ADFSRelyingPartyTrust –TargetIdentifier “” –NotBeforeSkew 2

#Set the skew to 2 minutes


ADFS 3.0

1) Get-ADFSRelyingPartyTrust –identifier “”

#Just to see what the values were
2) Set-ADFSRelyingPartyTrust –TargetIdentifier “” –NotBeforeSkew 2

#Set the skew to 2 minutes


We have found that this is almost always necessary to ensure reliable user authentications. 

Note that if you are using a subdomain, the identifier will be "https://<subdomain>"


3c) Configure Forms-based Authentication

ADFS 2.0

We've found that forms-based authentication (as opposed to ADFS' default of Windows-integrated authentication) supports a wider range of client browsers and operating systems, so we strongly encourage you to use this.  To make that switch:

Open "c:\inetpub\adfs\ls\web.config"

<add name="Integrated" page="auth/integrated/" />
<add name="Forms" page="FormsSignIn.aspx" />

<add name="Forms" page="FormsSignIn.aspx" />
<add name="Integrated" page="auth/integrated/" />

ADFS 3.0
With ADFS 3.0 you can enable both Windows Authentication and Forms Based Authentication at the same time. To do this within the ADFS Management Console, select the Authentication Policies folder in the left panel -> Action -> Edit Global Primary Authentication.
Check both Forms Authentication and Windows Authentication under Intranet, and click OK.
4. Send us your XML Metadata
It is important to get this data 1 week prior to when you want to start using SSO.
At this point, Jostle has been set up as relying party.  Now your organization needs to be set up as an identity provider in Jostle.  To do this,  please go to this URL: https://<your ADFS URL>/FederationMetadata/2007-06/FederationMetadata.xml and send the results back to Jostle.  Please, use our File Transfer method.
NOTE—whenever you renew/update your ADFS certification, you will need to send Jostle your new XML file once the certification has been applied on your end.


5. Convert Jostle password users to SSO

As you likely already have a few users who are using Jostle passwords, see our guide for converting those accounts to SSO authenticated.


TIP: Using SSO with the Jostle mobile app (iOS)

Our iOS mobile app does not support ADFS other than form-based configuration. For mobile iOS users, take these steps to avoid problems (eg. blank pages) when accessing Jostle via SSO:

  • make sure that the form-based configuration is ON in your ADFS.
  • make sure Mozilla/5.0 is not added in the list of WIASupportedUserAgents (since this will force the iOS device to use Windows Authentication, which will fail).
Was this article helpful?
5 out of 5 found this helpful
Have more questions? Submit a request


  • 0
    Eric Toll

    5. Convert Jostle password users to SSO

    As you likely already have a few users who are using Jostle passwords, see our guide for converting those accounts to SSO authenticated.



    #5 has a bad non working link

  • 0
    Permanently deleted user

    Hi Eric,

    Thanks for letting us know, we've updated the link.



Please sign in to leave a comment.