Authenticate users with AD FS and DigiCert​​®​​ account

Sign in as an administrator to the Windows server where you have installed AD FS.

Your sign-in account must have permission to configure AD FS settings.

From Server Manager, open AD FS > Tools > AD FS Management.

Select Relying Party Trust > Add Relying Party Trust.

In the Add Relying Party Trust wizard, select Claims aware.

Select Start.

To specify the data source, complete the following steps:

1. Select Import data about the relying party from a file.

2. For the Federation metadata file location, browse to the DigiCert​​®​​ metadata file that you previously exported.

3. Select Next.

For Specify Display Name, enter a name for the relying party, then select Next.

For Choose Access Control Policy, select the policy that you want to use for the trust, then select Next.

In the Ready to Add Trust page, verify the configuration settings, then select Next.

Select the Configure claims issuance policy for the application checkbox.

Select Close.

Open the AD FS Management console.

Select Relying Party Trusts, then select the trust that you want to configure.

Select Edit Claim Issuance Policy...

To configure the rule for mapping LDAP attributes to claims in the relying party, select Add Rule.

For the Rule Type in the Add Transform Claim Rule wizard, select Send LDAP Attributes as Claims, then select Next.

To configure the rule attributes, complete the following steps:

1. Enter a name for the rule.

2. For Attribute store, select Active Directory.

3. Map the LDAP attributes to outgoing claim types as indicated in the following table:

   For LDAP Attribute	For Outgoing Claim Type
   E-Mail-Addresses	Select E-Mail-Address
   Given-Name	Type in firstName
   Surname	Type in lastName

(Optional) Add more LDAP attributes from your identity provider that you want to expose in the SAML response.

For example, to include group membership for each user, map the LDAP Attribute Is-Member-of-DL to the outgoing claim type Group. This configuration would prompt the following type of SAML response:

...
  <AttributeStatement>
   <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
    <AttributeValue>user1@test.digicert.com</AttributeValue>
   </Attribute>
   <Attribute Name="firstName">
    <AttributeValue>Demo</AttributeValue>
   </Attribute>
   <Attribute Name="lastName">
    <AttributeValue>User1</AttributeValue>
   </Attribute>
   <Attribute Name="http://schemas.xmlsoap.org/claims/Group">
    <AttributeValue>CN=DigiCert Test Users,CN=Users,DC=test,DC=digicert,DC=com</AttributeValue>
    <AttributeValue>CN=Remote Management Users,CN=Builtin,DC=test,DC=digicert,DC=com</AttributeValue>
    <AttributeValue>CN=Remote Desktop Users,CN=Builtin,DC=test,DC=digicert,DC=com</AttributeValue>
   </Attribute>
  </AttributeStatement>
...

Select Finish.

To configure the rule for sending the mapped LDAP attributes to the relying party trust, select Add Rule.

For the Rule Type in the Add Transform Claim Rule wizard, select Transform an Incoming Claim, then select Next.

Enter a name for the rule.

For Incoming claim type, select E-Mail Address.

For Outgoing claim type, select Name ID.

For Outgoing Name ID format, select Email.

Select Pass through all claim values.

Select Finish.

Open Powershell with an Administrator account that has permission to edit the AD FS configuration.

Enter the following command:

Set-AdfsRelyingPartyTrust -targetname "<Relying Party Name>" -SamlResponseSignature  MessageAndAssertion

where <Relying Party Name> represents the name of the service provider.

For example:

Set-AdfsRelyingPartyTrust -targetname "SAML DC1 Login" -SamlResponseSignature  MessageAndAssertion

Open https://<adfs_host>/FederationMetadata/2007-06/FederationMetadata.xml in a browser, and save the xml.

Access the Account Manager (AM) Single sign-on with SAML page and select Upload IDP metadata.

Upload the FederationMetadata.xml downloaded from AD FS and select Save.