To configure the federated authentication settings, configure the Identity provider configuration, and set claims in the Claim editor.
NOTE: To access the Active Roles Web Interface for federated authentication purposes, you can use any of the following supported web browsers: Google Chrome, Mozilla Firefox, or Microsoft Edge on Windows 10.
To set identity provider configuration
-
In the Active Roles Configuration Center main window, click Web Interface.
The Web Interface page displays all the Active Roles Web Interface sites that are deployed on the web server running the Active Roles Web Interface.
-
To configure the federated authentication settings, click Authentication.
The Site authentication settings page is displayed.
NOTE: By default, the Default Windows authentication setting is configured.
-
To configure the federated authentication settings, click Federated.
-
In Identity provider configuration, from the Identity provider drop-down, select the security identity provider. The available options are Azure, ADFS, and Custom.
NOTE: For the Custom identity provider option, Active Roles supports the WS-Federation standard. However, One Identity Support cannot assist with custom WS-Federation-related configurations of third-party identity providers. For assistance in configuring Active Roles with a custom WS-Federation-related configuration of a third-party identity provider, contact One Identity Professional Services.
-
From Options, select the required additional options.
-
In Federated metadata URL, enter a valid URL.
NOTE: A federation metadata document is an XML document that conforms to the WS-Federation 1.2 schema. It exposes all data required for an STS implementer.
-
To test the connection, click Test metadata.
If the connection is successful, a message is displayed.
-
To view the metadata URL, click Yes. To proceed further with the settings, click No.
-
From Options, if you select the Token encryption, you must enter the Certificate thumbprint manually. If the Token encryption option is not selected, this field is not available.
NOTE: You must enter the Certificate thumbprint manually. Copying the key and pasting in the field is not supported.
-
In the Realm field, enter the realm URL of the requesting realm.
-
In the Reply URL field, enter the URL to send a response. A URL that identifies the address at which the relying party (RP) application receives replies from the Security Token Service (STS).
To set claims in the Claim editor
IMPORTANT: By default, the priority of the claim is set based on the order the claims are created. The claim created first has the first priority, the claim created next has the secondary priority, and so on. However, you can move the claims based on the required priority.
-
In Claim editor, to add claims, click Add.
The Add claim window is displayed.
-
From the Claim type drop-down, select the type of claim.
IMPORTANT: Active Roles supports UPN, EMAIL, SID, and GUID claims.
-
Select the Claim value.
-
In the Display name field, enter a name for the claim.
-
In the Claim description field, enter a description.
-
Click Save.
The claim is added successfully.
NOTE: You can modify or remove the claims that are created.
-
Click Modify.
If the operation is completed successfully, a message is displayed.
After you click Modify, the Web Interface is modified and ready for federated authentication.