Using Active Directory Federated Services to Authenticate to Certero | v8

Last updated 16 November, 20253 min read

From Certero version 8, there is the ability to use Federated Authentication via Active Directory Federated Services (ADFS). The following sections provide the instructions on how to use ADFS to authenticate to Certero.

Step 1 - Authentication Provider

Within Certero, go to Administrator > Authentication Providers
Click + New
Set the Type to WS-Fed
Set the Name something meaningful e.g. ADFS
Set the Metadata Url to
https://<adfsserver>/FederationMetadata/2007-06/FederationMetadata.xml
where <adfsserver> is the FQDN of your ADFS server.
Click Save

N.B. This step assumes that role Active Directory Federates Services has already been installed and a valid ADFS certificate exists (see Appendix A below).

Step 2 - ADFS Configuration

N.B. This step assumes that role Active Directory Federates Services has already been installed and a valid ADFS certificate exists (see Appendix A).

Login to the Active Directory Federated Services Server using an Administrator account
Open AD FS Management under Administrative Tools > AD FS Management
Select Add Relying Party Trust... in the right hand pane
Select Claims aware and click Start
Select Enter data about the relying party manually and click Next
Enter a friendly name under Display name , e.g. Certero, and add Notes if required
Click Next on the Configure Certificate Section
In the Configure URL section tick the box Enable support for the WS-Federation Passive Protocol
Enter the URL copied in Step 1 into the Relying party WS-Federation Passive Protocol URL e.g. https://<CerteroServerFQDN>/CerteroWebApp/signin-wsfed and Click Next
Configure Identifiers , in the “Relying party trust identifier” enter
e.g. https://<CerteroServerFQDN>/CerteroWebApp/Account/LogonFederated and click Next
Choose Access Control Policy - Permit Everyone, Click Next
In Ready to Add Trust, Click Next.
Tick the box Configure claims issuance policy for this application and click Close
Click Add Rule. Select Send LDAP Attributes as Claims in the drop down list and click Next
In the Claim rule name box type Send UPN as N ame
Select Active Directory as the Attribute store and map the User-Principal Name to the Name and click Finish

Step 3 - Test the ADFS Configuration

Go to Certero login page and click Choose a different authentication method .
Click the ADFS icon
Click the Sign in with ADFS button .
Providing both Step 1 and Step 2 have been completed successfully, you will be directed to the ADSF sign in page on your ADFS server. E.G.
Enter your username and password. The username can be in either domain\username or username@domain.com format. Click Sign in. You will now be logged into Certero via ADFS authentication.