Configuring Access Manager

Getting the AD FS 2.0 Metadata

1. Access the AD FS server metadata by accessing https://<<ADFS hostname or IP/FederationMetadata/2007-06/FederationMetadata.xml.

2. Save the AD FS metadata data.

3. Open the AD FS metadata file in a text editor (Notepad, WordPad, or an XML editor).

4. Remove the <RoleDescriptor> tags from the metadata.

   For example, remove the following tags:

     "<RoleDescriptor xsi:type="fed:ApplicationServiceType"
                 protocolSupportEnumeration=http://..................... ……> ……….</RoleDescriptor>

     "<RoleDescriptor xsi:type="fed:SecurityTokenServiceType"
                 protocolSupportEnumeration=http://.....  ………> </RoleDescriptor>

5. Save the changes.

Using the Metadata to Add a New Identity Provider Connection

1. Click Devices > Identity Server > Edit > SAML 2.0.

2. Click New > Identity Provider.

3. Specify the name as ADFS in Name.

4. Select Metadata Text from Source.

5. Specify the ADFS metadata that you copied in Step 5 in Text.

6. Click Next.

7. Specify an alphanumeric value that identifies the card in ID.

8. Specify the image to be displayed on the card in Image.

9. Update Identity Server.

Adding the AD FS Server Trusted Certificate

1. Retrieve the AD FS server's CA trusted root certificate.

2. Select Security > Certificates.

3. Select Trusted Roots.

4. Click Import.

5. Specify the certificate name, and browse for the AD FS certificate authority.

6. Click OK.

7. Click uploaded AD FS CA.

8. Click Add to Trusted Store and select config store.

9. Update Identity Server.

Configuring the Identity Provider in Access Manager

1. Select the AD FS Identity Provider in the SAML 2.0 tab.

2. Click Authentication Card > Authentication Request.

3. Select Response Protocol Binding to POST.

4. Select NAME Identifier Format as Transient.

5. Click OK.

6. Update Identity Server.