# Microsoft ADFS SSO

Squadcast supports SAML 2.0-based Single **Sign-On** (SSO) login for Microsoft Active Directory users and you can set it for your organization by following this integration guide.

### Pre-requisites <a href="#pre-requisites" id="pre-requisites"></a>

1. Account Owner / Administrator account in Squadcast

{% hint style="info" %}
**Points to Note:**

1\. Only an Administrator / Account owner can enable and configure Microsoft ADFS SSO for an organization in Squadcast.\
\
2\. Once enabled, only the Account owner can use email password-based login by default although it can be configured to enable email-based login for Administrators as well.
{% endhint %}

### Setup Instructions <a href="#setup-instructions" id="setup-instructions"></a>

1. Login to <mark style="color:red;">`app.squadcast.com`</mark> and navigate to the **Settings** > **Extensions**. Click the **Configure** button under SSO.

![](/files/wUaf2IfEd3ylidqSneDl)

2\. In the opened modal, select the **Custom SAML 2.0** tab and click **Show configuration guide for Custom SAML 2.0**.

![](/files/wxQbH7LLJxqmcMYQB2XE)

3\. As given in the displayed guide, copy the **ACS** URL. Then log in to your server and go to <mark style="color:red;">`Server Manager`</mark>.

![](/files/DkpWlVJSznhczXDBezrs)

4\. Go to <mark style="color:red;">`Tools`</mark> -> <mark style="color:red;">`ADFS Management`</mark>

![](/files/M6yfClDO07fMFCbpKqtJ)

5\. Click on <mark style="color:red;">`Add Relying Party Trust`</mark>.

![](/files/SIncGlxIQrDuUpv4WDJK)

6\. Select <mark style="color:red;">`Claims Aware`</mark> and click <mark style="color:red;">`Start`</mark>.

7\. Select <mark style="color:red;">`Enter data about the relying party manually`</mark> and click <mark style="color:red;">`Next.`</mark>

![](/files/x870lHDweWh2FeQgwA1G)

8\. Enter the <mark style="color:red;">`Display name`</mark>. Click <mark style="color:red;">`Next`</mark>.

![](/files/NZpQUgLtS1FE2lD4eX26)

9\. Select <mark style="color:red;">`Configure Certificate`</mark> and click <mark style="color:red;">`Next`</mark>.

![](/files/zxLDa5NV2QGSa2bGwriy)

10\. Select <mark style="color:red;">`Enable Support for the SAML 2.0 Web SSO protocol`</mark>. Enter the **ACS** URL you copied from Squadcast. Click <mark style="color:red;">`Next`</mark>.

![](/files/N89ArSMzoMxNo50HMCXw)

11\. Paste the **ACS** URL in <mark style="color:red;">`Relying on party trust identifier`</mark>. Click <mark style="color:red;">`Add`</mark>. Then click <mark style="color:red;">`Next`</mark>.

![](/files/vC1z2Bwvgk5hW1biukPW)

12\. Select <mark style="color:red;">`Access Control Policy`</mark>. Click <mark style="color:red;">`Next`</mark>.

![](/files/VfQD8h6A35p9RpxjeJUF)

13\. In <mark style="color:red;">`Ready to Add Trust`</mark>. Click <mark style="color:red;">`Next`</mark>. Then Click <mark style="color:red;">`Close`</mark>.

![](/files/Gi6HLw4yK4QRZT9Ns0fi)

14\. Click <mark style="color:red;">`Edit Claim Insurance Policy`</mark>.

![](/files/vN5wybiyYPdxoBflmoi6)

15\. Click <mark style="color:red;">`Add Rule`</mark>.

16\. Select <mark style="color:red;">`Send LDAP Attributes as Claims`</mark>. Click <mark style="color:red;">`Next`</mark>.

17\. Give a name. Select Attribute Store as <mark style="color:red;">`Active Directory`</mark>. And map **LDAP attributes** to **Outgoing Claim Type** as shown below. Map <mark style="color:red;">`E-Mail-Addresses`</mark> to <mark style="color:red;">`E-Mail Address`</mark>, <mark style="color:red;">`Given-Nam`</mark>`e` to <mark style="color:red;">`Given Name`</mark> and <mark style="color:red;">`Surname`</mark> to <mark style="color:red;">`Surname`</mark> Click <mark style="color:red;">`Ok`</mark>.

![](/files/iVjzMUlmHUQ51vP8ROQ0)

18\. Then Click <mark style="color:red;">`Add Rule`</mark>. Select <mark style="color:red;">`Send Claims using Custom Rule`</mark>. Click <mark style="color:red;">`Next`</mark>.

19\. Give a <mark style="color:red;">`Claim rule name`</mark>. And enter the following <mark style="color:red;">`Custom rule`</mark>. Click <mark style="color:red;">`Ok`</mark>.

![](/files/RjBAM5ir9OGdrrF3n053)

```
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"]
 => issue(Type = "last_name", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType);
```

20\. Repeat the Above step and add two more custom rules. Following are the two rules.

![](/files/43nFtCwn9hhcQliHiqh0)

```
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"]
 => issue(Type = "first_name", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType);
```

![](/files/5KcgyjiNyWE3YxrpdCD7)

```
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
 => issue(Type = "email", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType);
```

{% hint style="info" %}
**Points to Note:**

Make Sure the user accounts to be used for SSO have the first name, last name and email configured.
{% endhint %}

21\. Click <mark style="color:red;">`Apply`</mark>.

22\. Again, using the <mark style="color:red;">`Edit Claim Rule`</mark> wizard, add a rule using the template. <mark style="color:red;">`Transform an incoming claim`</mark> of type Email Address with Outgoing Claim Type Name ID and Outgoing Name ID Format as Email, passing through all claim values.

![](/files/g9qzobcO5D3EJbd0b3wu)

23\. In your **ADFS** management dashboard. Go to <mark style="color:red;">`Services->Certificates`</mark>. Select <mark style="color:red;">`Token Signing Certificate`</mark> and Click <mark style="color:red;">`View Certificate`</mark>. Go to <mark style="color:red;">`Details->Copy to Fil`</mark>`e` and export the Der encoded binary X.509 certificate.

![](/files/R9jUth94swUZ14U0SGFx) ![](/files/vDmyx5GiWT4D633XINRk) ![](/files/mIwlsXRtkyurgDSRQJGl) ![](/files/foVxJlxYKy2XI4PQfRh0) ![](/files/OMdBVjJC7S1hiEQYPZPg)

24\. Now convert the <mark style="color:red;">`.cer`</mark> file to a <mark style="color:red;">`.pem`</mark> file using the following command in Powershell.

```
openssl x509 -inform der -in certificatename.cer -out certificatename.pem
```

25\. Open the .pem file in a text editor. Copy the contents and paste them into Squadcast under <mark style="color:red;">`X.509 Certificate`</mark>. Then enter the <mark style="color:red;">`Saml 2.0`</mark> Endpoint as **https\:///adfs/ls**

{% hint style="info" %}
**Note:**

Make sure to add the **Domain Name** of your Organization, for SSO login to work
{% endhint %}

![](/files/qiP2Dod6ePYbWKvbM0Ah)

26\. Enable <mark style="color:red;">`SSO`</mark> and click <mark style="color:red;">`Save`</mark>.

27\. ADFS SSO is now configured. To test it you can go to **https\:///adfs/ls/idpinitiatedsignon**. Select Your application and sign in with your user account. You will be logged in to Squadcast and a user will be created.

![](/files/RT4444xfcT54TMsN5onP) ![](/files/DtK5tEXO5Hs0XwLuiQzu)

*Have any questions?* [*Ask the community*](https://community.squadcast.com/view/home)*.*


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://support.squadcast.com/single-sign-on-sso/microsoft-adfs-sso.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.