Configuring ADFS 3.0 as the Identity Provider
Before you start the configuration process, make sure that the Asset Explorer application is running in the HTTPS mode.
Then, configure Asset Explorer as a Relying Party Trust (RPT). This can be done either manually or using the metadata file.
To configure the Relying Party Trust manually
-
Open the ADFS management application.
-
Right-click Relying Party trust and choose Add Relying Party Trust option. The Add Relying Party Trust Wizard opens.
- Choose Claims Aware and click Next.
- Choose Enter data about the relying party manually and click Next.
-
Provide a Display Name and add Notes if any.
-
Click Next.
-
The next window is to upload the encryption certificate. You can skip this step as Asset Explorer does not support encryption of the SAML responses.
-
Click Next.
-
Select Enable support for SAML 2.0 Web SSO portal checkbox.
-
Enter the Assertion Consumer URL of Asset Explorer in the Relying Party SAML 2.0 SSO Service URL field.
-
Click Next.
-
In Relying Party Trust identifier, enter the Entity ID of Asset Explorer and click Add.
-
Click Next.
-
Choose Access Control Policy from the list and click Next.
-
Click Next.
-
Click Close. The Edit Claim Insurance Policy for Asset Explorer window opens.
-
Minimize the window and double-click Relying Party Trust to open its properties.
-
In the Signature tab, add the certificate file downloaded from Asset Explorer by clicking the Add button.
-
In the Endpoints tab, click Add SAML and choose the Endpoint Type as SAML Logout.
-
Enter the Single Logout Service URL of Asset Explorer in the Trusted URL and Response URL fields.
-
Click OK.
-
Under the Advanced tab, choose the Algorithm used in Asset Explorer from the drop-down.
-
Click Apply.
Configuring Relying Party Trust using the metadata file
-
Open the ADFS management application.
-
Right-click Relying Party trust and choose Add Relying Party Trust option. The Add Relying Party Trust Wizard opens.
-
Choose Claims Aware and click Next.
-
Choose Import data about the relying party from a file.
-
Click Browse and upload the SP metadata file.
-
Click Next.
-
Provide a Display Name for the RPT and click Next.
-
Choose Access Control Policy and click Next.
-
Click Next.
-
Click Close to complete the configuration.
-
After configuring Asset Explorer as a Relying Port Trust, the Edit Claim Insurance Policy for SDP window opens.
-
Click Add Rule.
-
In the Claim Rule template drop-down, choose Transform an Incoming Claim option and click Next.
-
Provide a Claim Rule Name.
-
Choose Windows Account Name as the Incoming claim type, Name ID for Outgoing claim type and Transient Identifier for Outgoing name ID format. Currently, ServiceDesk Plus supports Transient Identifier only.
-
Click Finish.
To download the IdP Certificate
-
Go to Services >> Certificates and click the Token-signing certificate.
-
Under the Details tab, click Copy to File option. The Certificate Export Wizard opens.
-
Choose DER encoded binary X.509 (.CER) and click Next.
-
Enter the location to save the file and provide the file name at the end of the URL.
-
Click Next. You must upload this certificate in Asset Explorer application to complete the integration.
|
Note
|
The login and logout URLs for ADFS 3.0 are as follows: Login URL: https://yourdomainname/adfs/ls Logout URL: https://yourdomainname/adfs/ls?SingleSignOut=SingleSignOut |
-
Click Finish.
You have now configured Asset Explorer as a service provider in ADFS 3.0.
Go to the SAML configuration page in Asset Explorer and provide the IdP details to complete the integration.