Guides

Set up SAML with ADFS (Active Directory Federation Services)

Step by step: register a SAML application in ADFS (Active Directory Federation Services), then check the sign-in with ID-Kit.

The steps

1. Gestion AD FS → Approbations de partie de confiance → Ajouter → “Claims aware” → “Import data about the relying party published online” and enter https://app.example.com/saml/metadata (or enter by hand: ID https://app.example.com/saml/metadata, ACS https://app.example.com/saml/acs).

2. Edit Claim Issuance Policy: rule "Send LDAP Attributes as Claims" (E-Mail-Addresses → E-Mail Address), then rule "Transform an Incoming Claim" (E-Mail Address → Name ID, format Email).

3. ID-Kit self-signed certificate: if ADFS rejects the signature, run Set-AdfsRelyingPartyTrust -TargetName "…" -SigningCertificateRevocationCheck None.

4. IdP metadata: https://YOUR-ADFS/FederationMetadata/2007-06/FederationMetadata.xml — paste it into ID-Kit.

Check the sign-in

Start a sign-in, get the SAML response, then paste it into theanalyseur : ID-Kit checks the signature, audience, receiving address and clock.

Common errors

• AD FS: MSIS7042, the same session made too many sign-in requests
• AD FS: MSIS7065, no protocol handler registered
• “Invalid signature” / “digest mismatch”
• “Unknown certificate” / “signature matches no certificate”