Set up an ADFS SAML connection

Single Sign-On is only available for enterprise customers.

1. Add a Relying Party Trust

See Create a relying party trust for complete details.

1. Launch your instance of ADFS and start the Add Relying Party Trust wizard.
2. On the Welcome page, choose Claims aware and click Start.
3. On the Select Data Source page, select Enter data about the relying party manually and click Next.
4. On the Specify Display Name page, set the following value for your relying party (urn:auth0:onemedia-consulting:YOUR_CONNECTION_NAME) and a brief description under Notes. Be sure to replace YOUR_CONNECTION_NAME with a the connection name provided by OneInsight Support. Click Next.
5. Go to the Configure Certificate page and upload the certificate that can be downloaded here, click Next.
6. On the Configure URL page, check the box for Enable support for the SAML 2.0 WebSSO protocol. The wizard then asks for a Relying party SAML 2.0 SSO service URL. Provide the following URL: https://onemedia-consulting.eu.auth0.com/login/callback?connection=YOUR_CONNECTION_NAME. Click Next.
7. On the Configure Identifiers page, indicate that the Relying party trust identifier is urn:auth0:onemedia-consulting:YOUR_CONNECTION_NAME. Click Next.
8. On the Choose Access Control Policy page, select Permit everyone and click Next.
9. Review the settings you provided on the Ready to Add Trust page and click Next to save your information. If you were successful, you'll see a message indicating that on the Finish page.
10. Make sure that the Configure claims issuance policy for this application checkbox is selected, and click Close.

2. Edit the Claim Issuance Policy

After you close the  Add Relying Party Trust wizard, the Edit Claim Issuance Policy window appears.

1. Click Add Rule... to launch the wizard.
2. Select Send LDAP Attributes as Claims for your Claim rule template, and click Next.
3. Provide a value for the Claim rule name, such as "LDAP Attributes" (it can be anything you want).
4. Choose Active Directory as your Attribute Store.
5. Map your LDAP attributes to the following outgoing claim types (OIDC Standard):

   6. Click  Finish.
   7. In the  Edit Claim Issuance Policy window, click Apply. You can now exit out of this window.

3. Export the Signing Certificate

Finally, you'll need to export the signing certificate from the ADFS console.

1. Using the left-hand navigation pane, go to ADFS > Service > Certificates. Select the Token-signing certificate, and right click to select View Certificate.
2. On the Details tab, click Copy to File.... This launches the Certificate Export Wizard. Click Next.
3. Choose Base-64 encoded X.509 (.CER) as the format you'd like to use. Click Next.
4. Provide the location to where you want the certificate exported. Click Next.

Verify that the settings for your certificate are correct and click  Finish.

4. Set up the connection in OneInsight

After creating the relying party trust in ADFS, you can finalize the set up by creating a new SAML connection in OneInsight. This task can be performed using OneInsight's admin interface or via OneInsight Support. Enter the following information:

• X.509 Signing Certificate: Signing certificate (encoded in PEM or CER) from earlier in this process.
• Sign In URL: SAML login URL.
• Sign Out URL (optional): SAML logout URL.
• Email Domains: These will be used to check for SSO connections at https://app.oneinsight.io/login (service provider initiated flow). The email domains that you can set in the admin interface is limited to the email domain of the currently logged in user. If you need additional email domains please contact support.