SSO with Active Directory Federation Services (ADFS)

3a) Configuring ADFS for Jostle: Configuring the relying party (Deploy certificates)

1. Save the Jostle public key certificate below (everything including ---- BEGIN CERTIFCATE ---- and ---- END CERTIFICATE ----) into a file called jostle.cer somewhere in the filesystem 
2. Start ADFS Management application 
3. In the Actions menu, select “Add Relying Party Trust” which will bring up the “Add Relying Party Trust Wizard” 
4. Select "Claims aware" in the Welcome screen and then Click ‘Start’ 
5. Select “Enter data about the relying party manual” and hit ‘Next’ 
6. Enter “Jostle” in Display name and hit ‘Next’ 
7. In the Configure Certificate step, hit ‘Browse’ and choose jostle.cer, then hit ‘Next’ 
8. In the Configure URL step, select ‘Enable support for the SAML 2.0 WebSSO Protocol’ and enter the following into the ‘Relying party SAML 2.0 SSO service URL': https://login-prod.jostle.us/saml/SSO/alias/newjostle.us
9. In the Configure Identifiers step, in the ‘Relying party trust identifier’ field enter: https://jostle.us  And then hit ‘Add’ and then ‘Next’
10. In the Choose Issuance Authorization Rules step, choose ‘Permit everyone’ and the hit ‘Next’ 
11. In the Ready to Add Trust step, hit ‘Next’ 
12. In the Finish step, check the ‘Open the Edit Claim Rules dialog for this relying party when this wizard closes’ and hit ‘Close’ 
13. When the Edit Claims Rules dialog comes up, select ‘Issuance Transform Rules’ tab and hit ‘Add Rule’ 
14. In Choose Rule Type step, under Claim rule template select ‘Send LDAP attributes as Claims’ and hit ‘Next’ 
15. In the Configure Claim Rule step, create a mapping as follows:
• Claim rule name: Email Addresses As Email
• Attribute Store: Active Directory
• Mapping of LDAP attribute to outgoing claim types: E-Mail-Addresses to E-Mail Address
16. Create another new rule by clicking 'Add Rule', under Claim rule template select ‘Transform an Incoming Claim’ and hit ‘Next’. 
17. In the Configure Claim Rule step, create a mapping as follows:
• Claim rule name: Email Address as Name ID
• Incoming claim type: E-Mail Address
• Outgoing claim type: Name ID
• Outgoing name ID format: Email
• Select 'Pass through all claim values' 
• Note: this rule should be Order 2 and the previous rule is Order 1
18. In the ADFS Management application, open the AD FS folder, then open Trust Relationship folder, then select Relying Part Trust’ and then double click on ‘Jostle’ in the Relying Party Trusts list. 
19. Select Signature tab and then hit ‘Add’, then select ‘jostle.cer’ and then hit ‘Open’, the ‘Apply’ and ‘OK” (if desired, for the Encryption tab leave it blank or add 'jostle.cer').
20. Select Advanced tab and change the secure hash algorithm to SHA-256.
21. You can optionally setup Single Sign Out. Right click Jostle under the list of Relying Party Trusts and go to Properties. Under the Endpoints tab, click Add SAML, set the Endpoint type to SAML Logout. Binding should be set to Post and the fill in the Trusted URL as follows: https://login-prod.jostle.us/saml/SingleLogout/alias/newjostle.us  Hit 'OK' then 'Apply'.

Public Key

 

3b) Set the NotBeforeSkew to allow for time drift between your server and ours:

Open Windows PowerShell via the Start Menu, and run these commands:

ADFS 2.0

1) Add-PSSnapin Microsoft.Adfs.PowerShell

#Load up the ADFS PowerShell plug in
2) Get-ADFSRelyingPartyTrust –identifier “https://jostle.us”

#Just to see what the values were
3) Set-ADFSRelyingPartyTrust –TargetIdentifier “https://jostle.us” –NotBeforeSkew 2

#Set the skew to 2 minutes

 

ADFS 3.0

1) Get-ADFSRelyingPartyTrust –identifier “https://jostle.us”

#Just to see what the values were
2) Set-ADFSRelyingPartyTrust –TargetIdentifier “https://jostle.us” –NotBeforeSkew 2

#Set the skew to 2 minutes

 

We have found that this is almost always necessary to ensure reliable user authentications. 

Note that if you are using a subdomain, the identifier will be "https://<subdomain>.jostle.us"

 

3c) Configure Forms-based Authentication

ADFS 2.0

We've found that forms-based authentication (as opposed to ADFS' default of Windows-integrated authentication) supports a wider range of client browsers and operating systems, so we strongly encourage you to use this.  To make that switch:

Open "c:\inetpub\adfs\ls\web.config"

change:
<add name="Integrated" page="auth/integrated/" />
<add name="Forms" page="FormsSignIn.aspx" />

to:
<add name="Forms" page="FormsSignIn.aspx" />
<add name="Integrated" page="auth/integrated/" />

ADFS 3.0

 

With ADFS 3.0 you can enable both Windows Authentication and Forms Based Authentication at the same time. To do this within the ADFS Management Console, select the Authentication Policies folder in the left panel -> Action -> Edit Global Primary Authentication.

 

Check both Forms Authentication and Windows Authentication under Intranet, and click OK.

 

 

At this point, Jostle has been set up as relying party.  Now your organization needs to be set up as an identity provider in Jostle.  To do this,  please go to this URL: https://<your ADFS URL>/FederationMetadata/2007-06/FederationMetadata.xml and send the results back to Jostle.  Please, use our File Transfer method.