Configuring a WS-Federation (AD FS) Provider - Identity and Access Management Services - 3.1 - 3.1 - Other

This type of provider uses WS-Federation (AD FS) to authenticate users and log them in.

Note:

Detailed instructions on how to configure a WS-Federation environment to correctly authenticate and return valid tokens for use with the Hyland IdP server are beyond the scope of this documentation. Detailed instructions for configuring your provider are available from the developer of the software being used.

To configure the Hyland IdP server to use WS-Federation:

Launch the Hyland IdP Administration client and log in (see Accessing the Hyland IdP Administration Client).
Upon successfully logging in, the tenant, provider, client connection, and API resource information is displayed. In a wide display, the tenant information is in the left pane and the providers, client connections, and API resources configured for that tenant are listed in the right pane. In a narrow display, the tenant information is at the top of the page and the provider, client connection, and API resource information is below it.
Click the Provider tab to view the providers currently configured for the tenant. The number of providers configured is displayed in parenthesis in the tab heading.
If this is a new provider, click Add New at the upper right of the providers list.

If you are configuring an existing provider, click its name in the list of providers.

The Provider configuration page is displayed. It is divided into the Basic Settings and Protocol areas. In a wide display, the Basic Settings area is on the left. In a narrow display, the Basic Settings area is at the top of the page.

Under Basic Settings, configure the following options.

Option	Description
Name	A unique name for the provider. This value is required and cannot contain any slashes (/ or \).
User Attribute Mapping	These settings are used to synchronize user attribute information. The schema definitions of the provider responses that contain the account declarations of the user logging in. The following attributes can be synchronized. UserId: The unique user identifier received from the external provider. This can be configured to use the username if the username does not change over time. This attribute is required. Username: The URI of the claim type in the provider response that contains the user name of the user logging in. This attribute is required. Email: The URI of the claim type in the provider response that contains the email address of the user logging in. Real Name: The URI of the claim type in the provider response that contains the real name of the user logging in. Group: The URI of the claim type in the provider response that contains the group membership of the user logging in.
Strip domain from username	Select this option to remove the domain from the user name before it is passed for authentication. This setting controls whether to automatically strip the domain from user names that are passed as either domain\username or username@domain. This is useful when providers use a full domain and user name but authenticating system only uses the user name.
Enable User Provisioning	Select this option to synchronize the user attributes defined in the User Attribute Mapping section when the user logs in. Note: User provisioning requires a SCIM Endpoint to be defined for the tenant. See Configuring the Tenant.
User Provisioning Create Enabled	Select this option to allow creating a new user in the tenant resource if the user logging in is not found. If this option is not selected and the user logging in is not found, that user is not logged in and an exception is returned. Note: User provisioning requires a SCIM Endpoint to be defined for the tenant. See Configuring the Tenant.
User Provisioning Update Enabled	Select this option to allow updating an existing user in the tenant resource if the user logging in is found. If this option is not selected, the incoming user information from the tenant is ignored and no updates are made to user information. Note: User provisioning requires a SCIM Endpoint to be defined for the tenant. See Configuring the Tenant.

Under Protocol, select WS-Federation from the Type drop-down list. The specific settings for AD FS providers are displayed.

Update the values of the AD FS settings to match your environment.

Setting	Description
Metadata	Enter the URL used to access the metadata about the AD FS server. The URL must use HTTPS. Note: This must be a valid URL, it cannot be a UNC path. If the URL used for the metadata value is not accessible, the AD FS provider will fail to load and cannot be used for authentication until the URL becomes accessible.
Realm	The URL of the requesting realm, which identifies the relying party (RP) to the security token service (STS). This is the URL of the Hyland IdP server identified as the relying party on the AD FS server. For example, if the root address of the Hyland IdP server is https://server-018.mydomain.net/identityprovider and the tenant name is Company1, then the URL is: https://server-018.mydomain.net/identityprovider/Company1 Note: This value is case sensitive and must match exactly the Relying Party Trust identifier URL on the AD FS server.

Setting

Description

Metadata

Enter the URL used to access the metadata about the AD FS server. The URL must use HTTPS.

Note:

This must be a valid URL, it cannot be a UNC path. If the URL used for the metadata value is not accessible, the AD FS provider will fail to load and cannot be used for authentication until the URL becomes accessible.

Realm

The URL of the requesting realm, which identifies the relying party (RP) to the security token service (STS).

This is the URL of the Hyland IdP server identified as the relying party on the AD FS server.

For example, if the root address of the Hyland IdP server is https://server-018.mydomain.net/identityprovider and the tenant name is Company1, then the URL is:

https://server-018.mydomain.net/identityprovider/Company1

Note:

This value is case sensitive and must match exactly the Relying Party Trust identifier URL on the AD FS server.

Click Save in the lower right corner of the page.

Note:
If you are configuring the Hyland IdP for use with an OnBase environment, you must also configure a default User Group in OnBase to assign new users to when accounts are created in OnBase from federated credentials.
On the AD FS server, create a Relying Party Trust between the AD FS server and the clients using the Hyland IdP for authentication. The Relying Party Trust identifier must use the same URL as specified for the Realm value on the Hyland IdP server.

Tip:
For more information on creating a Relying Party Trust, see Adding a Relying Party Trust for WS-Federation (AD FS).