You can configure a relying party trust for SAML authentication with Historical Reporting. The terms used here are specific to Active Directory Federation Services (ADFS) on Windows Server 2016 as an Identity Provider (IDP).
Before you begin
You must have the unique identifier of the web application to be recognized by the IDP. For example, AnalyticsWebHome.
URL from which IDP sends and receives SAML requests and responses. For example, https://cluster.fqdn/AvayaAnalytics.
Log in to Active Directory Federation Services (ADFS) server and open the ADFS Management UI.
Click Add Relying Party Trust to add a new relying party trust.
On the Welcome page, select the Claims aware option and click Start.
In the Select Data Source window, select Enter data about the relying party manually option and click Next.
In the Specify Display Name window, add a name for this relying party trust and click Next.
In the Configure Certificate window, leave blank if not applicable and click Next.
In the Configure URL window, click Enable support for the SAML 2.0 WedSSO protocol option, and then add the URL from which IDP sends and receives SAML requests and responses. Click Next.
In the Configure URL window, add the URL from which IDP sends and receives SAML requests and responses. Click Next.
ADDITIONAL INFORMATION:
For example, https://cluster.fqdn/AvayaAnalytics and append on /saml/SSO
In the Configure Identifiers window, add the unique identifier of the web application to be recognized by the IDP and click Next.
ADDITIONAL INFORMATION:
For example, AnalyticsWebHome.
In the Choose Access Control Policy, select the required access control policy and click Next.
In the Ready to Add Trust window, confirm your settings and click Next.
In the Finish window, check the configure claims issuance policy for this application and click Close.
In Edit Claim Issuance Policy for your relying party trust, click Add Rule.
In the Select Rule Template window, select Send LDAP Attributes as Claims from the dropdown and click Next.
In the Configure Rule window, add the rule name. For example, Name ID.
ADDITIONAL INFORMATION:
Identify the Attribute store as Active Directory from the drop down menu.
To map the SAM-Account-Name to Name ID of the user from the LDAP Attribute, select or type SAM-Account-Name, and for the Outgoing Claim type, select Name ID.
To map the Distinguished name of the user from the LDAP Attribute, select or type distinguishedname, and for the Outgoing Claim type, select or type DistinguishedName.
To map the E-Mail Address of the user from the LDAP Attribute, select or type E-Mail-Addresses, and for the Outgoing Claim type, select or type EMail.
To map the DisplayName of the user from the LDAP Attribute, select or type Display-Name, and for the Outgoing Claim type, select or type DisplayName.
To map the Groups name of the user from the LDAP Attribute, select or type Token-Groups – Unqualified Names, and for the Outgoing Claim type, select or type Groups.
ADDITIONAL INFORMATION:
Note:
The following strings must match with attributes as provided when configuring SAML using post-install steps:
DistinguishedName must match the User display name attribute
EMail must match the User email address attribute
DisplayName must match the User distinguished name attribute
Groups must match the User group attribute
To add a SAML logout endpoint, do the following:
Select Properties to edit the relying party trust.
Go to the Endpoints tab.
Select Add SAML,
On the Add Endpoint window, select SAML logout from dropdown list.
For Binding select POST from dropdown list.
For the trusted URL, add the URL from which IDP sends and receives SAML requests and responses. Click Ok.
ADDITIONAL INFORMATION:
https://cluster.fqdn/AvayaAnalytics and append on /saml/SingleLogout
To export the IDP metadata.xml, enter the URL of the ADFS server.
