Microsoft ADFS SSO
Enable Microsoft ADFS Single Sign On (SSO) for your Squadcast organisation
Squadcast supports SAML 2.0-based Single Sign-On (SSO) login for Microsoft Active Directory users and you can set it for your organization by following this integration guide.
- 1.Account Owner / Administrator account in Squadcast
Points to Note:
1. Only an Administrator / Account owner can enable and configure Microsoft ADFS SSO for an organization in Squadcast.
2. Once enabled, only the Account owner can use email password-based login by default although it can be configured to enable email-based login for Administrators as well.
- 1.Login to
app.squadcast.comand navigate to the Settings > Extensions. Click the Configure button under SSO.
2. In the opened modal, select the Custom SAML 2.0 tab and click Show configuration guide for Custom SAML 2.0.
3. As given in the displayed guide, copy the ACS URL. Then log in to your server and go to
Server Manager.
4. Go to
Tools -> ADFS Management
5. Click on
Add Relying Party Trust.
6. Select
Claims Aware and click Start.7. Select
Enter data about the relying party manually and click Next.
8. Enter the
Display name. Click Next.
9. Select
Configure Certificate and click Next.
10. Select
Enable Support for the SAML 2.0 Web SSO protocol. Enter the ACS URL you copied from Squadcast. Click Next.
11. Paste the ACS URL in
Relying on party trust identifier. Click Add. Then click Next.
12. Select
Access Control Policy. Click Next.
13. In
Ready to Add Trust. Click Next. Then Click Close.
14. Click
Edit Claim Insurance Policy.
15. Click
Add Rule.16. Select
Send LDAP Attributes as Claims. Click Next.17. Give a name. Select Attribute Store as
Active Directory. And map LDAP attributes to Outgoing Claim Type as shown below. Map E-Mail-Addresses to E-Mail Address, Given-Name to Given Name and Surname to Surname Click Ok.
18. Then Click
Add Rule. Select Send Claims using Custom Rule. Click Next.19. Give a
Claim rule name. And enter the following Custom rule. Click Ok.
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"]
=> issue(Type = "last_name", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType);
20. Repeat the Above step and add two more custom rules. Following are the two rules.
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"]
=> issue(Type = "first_name", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType);
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
=> issue(Type = "email", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType);
Points to Note:
Make Sure the user accounts to be used for SSO have the first name, last name and email configured.
21. Click
Apply.22. Again, using the
Edit Claim Rule wizard, add a rule using the template. Transform an incoming claim of type Email Address with Outgoing Claim Type Name ID and Outgoing Name ID Format as Email, passing through all claim values.
23. In your ADFS management dashboard. Go to
Services->Certificates. Select Token Signing Certificate and Click View Certificate. Go to Details->Copy to File and export the Der encoded binary X.509 certificate.%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(3).png?alt=media)
%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(4).png?alt=media)
%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(5).png?alt=media)
%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(3).png?alt=media)
%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(1)%20(7).png?alt=media)
24. Now convert the
.cer file to a .pem file using the following command in Powershell.openssl x509 -inform der -in certificatename.cer -out certificatename.pem
25. Open the .pem file in a text editor. Copy the contents and paste them into Squadcast under
X.509 Certificate. Then enter the Saml 2.0 Endpoint as https:///adfs/lsNote:
Make sure to add the Domain Name of your Organization, for SSO login to work
26. Enable
SSO and click Save.27. ADFS SSO is now configured. To test it you can go to https:///adfs/ls/idpinitiatedsignon. Select Your application and sign in with your user account. You will be logged in to Squadcast and a user will be created.
