Technical Tip: Configuring user verification with ADFS authentication

[aliyavuzer]

Description	This article describes how to configure user verification with ADFS SAML authentication.
Scope	FortiClient, EMS.
Solution	EMS Configuration: For creating a new SAML Configuration Navigate to EMS -> User management -> Saml Configuration and select the '+ Add' button. Provide a name. Select 'Authorization Type' as 'None'. Hit the Use Current URL. SP information will be used while configuring ADFS Saml configuration. Now, create the Microsoft ADFS Saml Configuration for EMS. Microsoft ADFS configuration: In AD FS Manager, 'right-click' on Relying Party Trust and select Add Relying Party Trust. On the Welcome page, select Claims Aware and select Start. On the Select Data Source page, select Enter data about the relying party manually and select Next. On the Specify Display Name page, type a name in Display name under Notes type a description for this relying party trust, and then select Next. On the Configure Certificate page, select Next to skip the configuration. On the Configure URL page, select Enable support for the SAML 2.0 Web SSO protocol and enter the single sign-on URL that can be gathered from EMS -> User Management -> SAML Configuration window. (SP ACS (login) URL ). On the Configure Identifiers page, enter the SP entity ID from the EMS Saml configuration window.   On the Choose Access Control Policy page, select a policy and select Next.  On the Ready to Add Trust page, review the settings and select Next to save the relying party trust information. On the Finish page, select Close. This action automatically displays the Edit Claim Rules dialog box. Select Add Rule. Enter the Claim rule name, select Active Directory under Attribute store, add mapping of LDAP attributes for Name and Name ID, and select OK. Configure the Claims rule as below: Select Finish and complete the configuration: Navigate under AD FS -> Service -> Certificates and export the Token-signing certificate with Base-64 format. Turn back to the EMS Saml Configuration window: Configure IDP settings based on the ADFS IP/FQDN information. Browse the signing certificate that was downloaded at the previous step. Test and save the settings. When SAML Configuration is done,  create an invitation code and authorize users from ADFS Saml authentication.