Skip to main content

Configuring a CentreStack Tenant with AD FS as a SAML Identity Provider

Jeff Reed
Updated

Background

Some CentreStack tenants may already be using Active Directory Federation Services (AD FS) and wish to use their Active Directory credentials for single sign-on to CentreStack. This article describes how a CentreStack tenant can be federated with an AD FS such that AD FS is the Security Assertion Markup Language (SAML) Identity Provider (IdP0 and CentreStack will be the SAML Relying Party (RP).

Known Limitations

  • CentreStack build 10.2.6335.43041 or later is required.

Configuration

  1. On the AD FS server, start the Server Manager application.
  2. From the Tools menu, select AD FS Management
  3. In the AD FS application, click on the Relying Party Trusts node in the left-most pane.
  4. Click Add Relying Party Trust… in the right-most Actions pane.
  5. The Claims aware option should be enabled, then click the Start button:ADFS1.png
  6. Enable SSO in your CentreStack tenant:


    For newer versions:
    sso.png
  7. Select the text in the Access service provider meta data using the following link field and copy it to the clipboard, in this example: 
    https://cstackjjr.hadroncloud.com/portal/saml2.aspx?sso=y6oL0772
  8. Back in the AD FS Management application, enable the Import data about the relying party published online or on a local network option, then paste the text from the Access service provider metadata using the following link text box into the Federation metadata address field:
  9. Click the Next button in the preceding dialog
  10. Update the Display Name and Notes fields appropriately, then click the Next button:
  11. For the purposes of this example, select Permit everyone and click Next:
  12. Click Next in this dialog (all of the necessary settings for the CentreStack Relying Party were already specified in the XML document that was imported):
  13. Leave the Configure claims issuance policy for this application enabled, then click the Close button:
  14. With the new relying party selected in the middle pane, click Edit Claim Issuance Policy... in the Actions pane.
  15. In the Edit Claim Issuance Policy… dialog, click the Add Rule… button:
  16. From the Claim rule template drop-down, select Send Claims Using a Custom Rule, then click the Next button:
  17. Use these values:
    • Claim rule name: Generate opaque identifiers
    • Custom rule: (Copy and paste the text below and replace the sts.hadroncloud.com in the text with the FQDN of your AD FS server) 
      c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]
       => add(store = "_OpaqueIdStore", types = ("http://sts.hadroncloud.com/internal/persistentId"), query = "{0};{1};{2}", param = "ppid", param = c.Value, param = c.OriginalIssuer);
    • Click OK in the preceding dialog
  18. Click the Add Rule button for the second time:
  19. From the Claim rule template drop-down, select Transform an Incoming Claim, then click the Next button:
  20. Use these values
    • Claim rule name: Create Persistent Name ID
    • Incoming claim type: http://sts.hadroncloud.com/internal/persistentId (paste the text, ignoring the drop-down control, and replace sts.hadroncloud.com with the FQDN of your AD FS server)
    • Outgoing claim type: Name ID (using the drop-down control)
    • Outgoing name ID format: Persistent Identifier (using the drop-down control)

    • Click OK in the preceding dialog
  21. Click the Add Rule button for the third time:
  22. From the Claim rule template drop-down, select Send LDAP Attributes as Claims, then click the Next button:
  23. In the Configure Rule dialog:
    • Claim Rule name text box type: Send CentreStack Attributes,
    • Select Active Directory from the Attribute store drop-down.
    • In the LDAP Attribute field, select User-Principal-Name, and in the Outgoing Claim Type select Name.
    • For the next LDAP Attribute field, select Given-Name and then Given Name for the Outgoing Claim Type.
    • Finally, the last LDAP attribute is Surname, and the Outgoing Claim Type is Surname.
    • The Configure Rule dialog should look like this, then click Finish:

      Click Finish
  24. Now that the three rules have been defined, click the OK button:
  25. Switch back to the browser where the CentreStack SINGLE SIGN ON page is displayed.
  26. Optional: Enable Add SSO link to login page:
    ADFS15.png
    It is recommended that this option be disabled. This option doesn't make sense in a multi-tenant deployment where more than one tenant may be using SAML for single sign-on. End-users will sign in using the so-called "RP initiated sign-on URL" displayed in the Access single signon functionality using the following link text box at the top of the page, or through the "IdP initiated sign-on URL" provided by AD FS (i.e., https://<fqdn>/adfs/ls/idpinitiatedsignon.aspx, where "<fqdn>" is the fully qualified domain name of the AD FS server farm.
  27. Add some descriptive text in the Display text for SSO link. This text will only be displayed in the CentreStack sign-on dialog if the Enable Add SSO link to login page option is enabled.
    ADFS16.png
  28. Optional: Enable the Create user when User Doesn't Exist option:

    ADFS17.png
    If this option is enabled, users will be automatically created in the CentreStack tenant after they have been authenticated with AD FS. This is very convenient in most situations.
  29. Set the SSO Provider to AD FS:
  30. Set the Fully Qualified Domain Name to the FQDN of your AD FS server (in this example, the AD FS is sts.hadroncloud.com):
  31. Click the Save icon:
  32. Test it by navigating to:
    1. The IdP initiated sign-on URL:
      https://<fqdn>/adfs/ls/idpinitiatedsignon.aspx
    2. The RP initiated sign-on URL, which is the URL specified in the Access single signon functionality using the following link text box.

Troubleshooting

Database Column Width

If your CentreStack server was deployed prior to late 2018, it's possible that you will see this error when saving the settings in the GROUP POLICY HOME > SINGLE SIGN ON page:

This may be caused by the AD FS server responding with a metadata XML doc whose size exceeds the column width of the Value column in the xaf_namedvalue table in the CentreStack database. More recent versions of CentreStack avoid this problem by having a database schema that defines the Value column as type MEDIUMTEXT. Unfortunately, older versions of CentreStack that were upgraded to later versions don't have their schema altered. It is possible to work around this problem by running this MySQL command:

ALTER TABLE csmain.xaf_namedvalue MODIFY COLUMN Value MEDIUMTEXT

You may want to contact CentreStack technical support for help running this command.

SAML Devtools Extension for Chrome

For any errors reported by the browser when signing in, it may be very useful to examine the SAML assertion using an extension for Google Chrome:

  1. Start Chrome on the client and navigate to: https://chrome.google.com/webstore/category/extensions?hl=en-US
  2. In the search box, type: saml devtools extension:
  3. For the extension offered by stefan.rasmusson.as. click the Add to Chrome button:
  4. Click the Add Extension in the next dialog.
  5. The SAML extension will be displayed in Chrome:
  6. To use the tool, press F12 to display Chrome's developer tools, the click the SAML tab, then click the Show only SAML option:
  7. In the address bar, navigate to the Relying Party Initiated Sign On URL, for example: https://cstackjjr.hadroncloud.com/portal/LoginPage.aspx?sso=y6oL0772
  8. Sign into the AD FS idpinitiatedsignon.aspx  page:
  9. Click on the last POST in the middle pane to view the SAML assertion. Click on the SAML tab to view the XML data:
  10. The most important part of the XML data is the Attributes in the assertion. This is usually where problems happen because CentreStack requires the name, givenname and surname attributes similar to what is seen here:

Related articles

Comments

5 comments

Date Votes
  • stokes

    Thanks for sharing the detailed guide. Similarly, when using the nbi appointment online system, make sure all details are submitted correctly so your request is processed without issues.

     

    -1
  • Kafleen Qalmar

    PKT to LYT time converter all my googling outputs brought to me to article like yours where you described how to change the defualt save location setting to another specifc location, but i have not a specificic location in mind now. I just want word opens or when I brows for files, takes me to the most recent folder I used my very last time, can you help me with this?


     

    0
  • Mary Grace

    This guide really help me while setup AD FS with CentreStack. Metadata import part make things more easy. We also using this kind SSO access for some NBI Clearance Cebu related files and login work. Thanks for sharing this.

    0
  • stokes

    acta de nacimiento gratis en pdf all my googling outputs brought to me to article like yours where you described how to change the defualt save location setting to another specifc location, but i have not a specificic location in mind now. I just want word opens or when I brows for files, takes me to the most recent folder I used my very last time, can you help me with this?


     

    0
  • BluFx

    Both identity-based authentication systems and secure clearance-style workflows are built around the same idea of verifying a user before granting access, ensuring only authorized individuals can proceed; in AD FS with SAML integration for CentreStack, this is done through a trusted identity provider that validates credentials against directory services and passes secure assertions to the application, which reflects the same structured access control principle used in document clearance processes like NBI verification where identity confirmation is required before services or records are released.

    0

Please sign in to leave a comment.