--- title: "Using Active Directory Federated Services to Authenticate to Certero | v8" canonical: "https://ai-docs.certero.com/space/CUP/118655423/Using%20Active%20Directory%20Federated%20Services%20to%20Authenticate%20to%20Certero%20%7C%20v8" format: markdown --- From Certero version 8, there is the ability to use Federated Authentication via Active Directory Federated Services (ADFS). The following sections provide the instructions on how to use ADFS to authenticate to Certero. ## Step 1 - Authentication Provider 1. Within Certero, go to Administrator > Authentication Providers 2. Click + New 3. Set the Type to WS-Fed 4. Set the Name something meaningful e.g. ADFS 5. Set the Metadata Url to https://<adfsserver>/FederationMetadata/2007-06/FederationMetadata.xml where <adfsserver> is the FQDN of your ADFS server. 6. Click Save <span style="color: #000000">N.B. This step assumes that role Active Directory Federates Services has already been installed and a valid ADFS certificate exists (see Appendix A below). </span>  ## <span style="color: #000000">Step 2 - ADFS Configuration </span> <span style="color: #000000">N.B. This step assumes that role Active Directory Federates Services has already been installed and a valid ADFS certificate exists (see Appendix A). </span> 1. <span style="color: #000000">Login to the Active Directory Federated Services Server using an Administrator account </span> 2. <span style="color: #000000">Open AD FS Management under Administrative Tools > AD FS Management </span> 3. <span style="color: #000000">Select </span><span style="color: #0000ff">Add Relying Party Trust... in the right hand pane </span> 4. <span style="color: #000000">Select </span><span style="color: #0000ff">Claims aware </span><span style="color: #000000">and click Start </span> 5. <span style="color: #000000">Select </span><span style="color: #0000ff">Enter data about the relying party manually and click Next </span> 6. <span style="color: #000000">Enter a friendly name under Display name , e.g. Certero, and add Notes if required </span> 7. <span style="color: #000000">Click Next on the Configure Certificate Section </span> 8. In the <span style="color: #000000">Configure URL </span>section tick the box Enable support for the WS-Federation Passive Protocol 9. Enter the URL copied in Step 1 into the Relying party WS-Federation Passive Protocol URL e.g. https://<CerteroServerFQDN>/CerteroWebApp/signin-wsfed and Click Next 10. <span style="color: #000000">Configure Identifiers , in the “Relying party trust identifier” enter </span> <span style="color: #000000">e.g. https://<CerteroServerFQDN>/CerteroWebApp/Account/LogonFederated and click Next </span> 11. <span style="color: #000000">Choose Access Control Policy - Permit Everyone, Click Next </span> 12. <span style="color: #000000">In Ready to Add Trust, Click Next. </span> 13. Tick the box Configure claims issuance policy for this application and click Close 14. Click Add Rule. Select Send LDAP Attributes as Claims in the drop down list and click Next 15. In the Claim rule name box type Send UPN as N ame 16. Select Active Directory as the Attribute store and map the User-Principal Name to the Name and click Finish ## <span style="color: #000000">Step 3 - Test the ADFS Configuration </span> 1. Go to Certero login page and click Choose a different authentication method . 2. Click the ADFS icon 3. Click the Sign in with ADFS button . 4. Providing both Step 1 and Step 2 have been completed successfully, you will be directed to the ADSF sign in page on your ADFS server. E.G. 5. Enter your username and password. The username can be in either domain\username or username@domain.com format. Click Sign in. You will now be logged into Certero via ADFS authentication. ## Appendix A - ADFS Certificate 1. ADFS requires a valid digital certificate. 2. The Subject should match the ADFS server FQDN. 3. Enhanced Key Usage = Server Authentication 4. The Certificate Subject Alternative Name should have certauth.<server FQDN> Here is an example showing the Subject Alternative Name for an ADFS server called adfs.training.certero.local 