# Steps to configure SAML 2.0 SSO with Microsoft Active Directory Federation Services

<div class="support-faqs__products products" id="bkmrk-products%3A%C2%A0%C2%A0%C2%A0learn"><span class="product__subtitle">PRODUCTS: </span>[Learn](https://www.ispringsolutions.com/support/learn)</div><span class="cursive">Note:</span> ADFS 2.0 on Windows Server 2008 r2 or ADFS 3.0 on Windows Server 2012 / 2012 r2)

SAML 2.0 single sign-on (SSO) supports integration with [Microsoft Active Directory Federation Services](https://docs.microsoft.com/en-us/windows-server/identity/active-directory-federation-services) (ADFS) 3.0.

Requirements

<div class="support-faqs__text support-faqs__text-block" id="bkmrk-a-fully-installed-an">- A fully installed and configured ADFS service.
- A server running Microsoft Server 2008r2 or 2012/2012r2
- An SSL certificate to sign your ADFS login page and the thumbprint of that certificate

</div>In this example we are using <span class="emphasis">ADFS 2.0</span> on <span class="emphasis">Windows Server 2008 R2</span>. On Windows Server 2012 the steps will be the same except for the installation, because you install AD FS role via the server manager, not via the installation package as on Windows 2008 server r2.

## Step 1. AD FS Management

Login in to your AD FS server and launch the ADFS Management Console via the shortcut in Control Panel\\Administrative Tools.

![](https://lh3.googleusercontent.com/txyVmpwGv__tSTGJwXYyz0yC82ytijIjSb4t7TwX5aj2V7PBfMQHxioflnVrcd2zqsxe_DCaLQ3rsJMBsv1erQR9aFIRqDhL8G9x2Q1MFc5Gu3iKLfJ2Q2wBOQ6-0DUE1vbajQKM)

## Step 2. Check AD FS settings

Right-click on <span class="emphasis">Service</span> and sel ect <span class="emphasis">Edit Federation Service Properties...</span>

![](https://lh3.googleusercontent.com/vpNhOmi5zA7XXr4zymN9Z2U4N5FQ5qsIaRdfJlknxBk8uXBO9wYo_mC3WsG9XQTJb6O4Z7eMNRwPlr_51L8tJosX4Mq44ioveAOuQxHW-S03mpi4HyJYuufE9qM6g5SiYPv7omFx)

Confirm that the General settings match your DNS entries and certificate names. Make a note with the Federation Service Identifier, since that is used in the iSpring Learn SAML 2.0 configuration settings.

![](https://lh5.googleusercontent.com/1sY5XuJ0_hrWRWv07Qgv4f6mznJNfcQAYm-QLkN49QtLoExMMAmvhoD3SdVgo9KN9DjG92zjt3vjiWaKVjZxH3pPNHIfLhRBlAQ8HOLMg6l6uG6jN1-dEbjqlaotW1WU_dafDnQP)

## Step 3. Token-Signing certificate

<div class="support-faqs__text support-faqs__text-block" id="bkmrk-browse-to-the-certif">1. Browse to the certificates.
2. Right-click on the certificate and sel ect <span class="emphasis">View Certificate</span>.
3. Go to the <span class="emphasis">Details </span>tab.
4. Find the <span class="emphasis">Thumbprint </span>field and copy the contents of this field to the Windows clipboard.

</div>![](https://lh5.googleusercontent.com/RWYwuaq5guXjKsQRWl50CwbHAbzlSJh2QVh-T9xA5xKBVihAiVxMs3YCTJ_xcGv7XzqWnqLGXOkponiAJjjcXb_IIUFKbmBoTbW1X2ZCP2fF3N1P2fWAgSsLlbNar3IsvGYOsqEe)

## Step 4. Learn Settings

<div class="support-faqs__text support-faqs__text-block" id="bkmrk-log-in-into-your-isp">1. Log in into your iSpring Learn account and go to the SSO settings via this link: [https://YourAccоuntURL.ispringlearn.com/settings/sso](https://xn--youraccunturl-o7k.ispringlearn.com/settings/sso)
2. Ins ert your Thumbprint into the <span class="emphasis">Certificate Fingerprint field</span> and remove all spaces between characters.
3. Enter your data to the <span class="emphasis">Metadata URL</span>, <span class="emphasis">Sign ON URL</span> and <span class="emphasis">Logout URL</span> fields.

</div>![SAML01.png](https://www.ispringsolutions.com/upload/medialibrary/819/Group%2070.png "SAML01.png")

## Step 5. ADFS Relying Party Configuration

Go to the <span class="emphasis">ADFS Management console</span> and select <span class="emphasis">Relying Party Trusts</span>, right-click on it and select Add Relying Party Trust…

![](https://lh3.googleusercontent.com/DWe2TCjpUD-9mwb9YE-Yi_3VQvvLo6w5S4K9Tqo5iu3ytTrfMkakrv2THOkYo9HFrYZJMUyGxQCOOha-7EbJ_m01BApEktCKSvK8qKblvO3YjO_rn0xJkqEARD3Ejm6wUJq5f9wG)

Select <span class="emphasis">Next</span> On the Welcome Screen of the wizard, and on the <span class="emphasis">Select Data Source</span> step, select the last option: <span class="emphasis">Enter data about the relying party manually</span>.

![](https://lh4.googleusercontent.com/FedR8yJMFy79Wm7ZOapfx8-RgWO8Syz-VFPk5VezbDvw_urdX2UCWCFEakA7sMeQsRcVARsoJKANp8gKd0W4xFGCV1spuY-WMwoPl2-cWUVJu4ZK0laxej3G87m7a6ZFJumLTd6B)

On the next screen, enter a <span class="emphasis">Display name</span> that you will recognize in the future.

![](https://lh6.googleusercontent.com/gHTy1NaSaFcC9tAVCwq4nrI2YFD9YJQ8j_BVccexWw2E6wWMG9kkBI4su3Mf_kGmhhPf5lkCm-8p5W6i-L6119hROkAYqN6VzBELMM7SnVLx7f6VL_rf-Ew73Jrxr0ZGvy5V9bXa)

Next, select <span class="emphasis">AD FS profile</span>:

![](https://lh5.googleusercontent.com/phGZye3RG4RuFv7kujBnkKtD75sg-YOU4hPlQHv--3weu7qnzB2QgwYSJ5a0vEWititNIzz_WbNDbojReboku0G12BXh4ZTJjl2w2hq2jNxipm6M6DCDVmI31FRvbEYr4IVMLR1v)

Leave the default values:

![](https://lh3.googleusercontent.com/E2twaBJWzoKspzzxkn-26XSsvalo8wAL3ayJYM3fVtszGyegf2o4-729bwV7jzammYv6Az1Ew2Mj--G3Kw4NZo0OkMXGD_OIpz2SfPgeRvb1axp1g81p48cGyUrMjxYJAye53kJ8)

On the next screen, check the box labeled: <span class="emphasis">Enable support for the SAML 2.0 WebSSO protocol</span>. The service URL will be: [https://YourAccоuntURL.ispringlearn.com/module.php/saml/sp/saml2-acs.php/default-sp](https://xn--youraccunturl-o7k.ispringlearn.com/module.php/saml/sp/saml2-acs.php/default-sp)

![](https://lh6.googleusercontent.com/eJxJWt1KAQ5E7ldDZmtzrdiFB4icMGUHoVL5pDbAwO98o8CgHPIBOF73CHPQ6H1Cm7HuPbN4z-ZLf3Qt_ygNTiEvKumyN2JzJ023bHvXOfQFhapElpWZ0m7-Az1uVxsUtVAr6xNP)

Click <span class="emphasis">Next</span>. Add Relying party trust identifier: [https://YourAccоuntURL.ispringlearn.com/module.php/saml/sp/metadata.php/default-sp](https://xn--youraccunturl-o7k.ispringlearn.com/module.php/saml/sp/metadata.php/default-sp)

![](https://lh5.googleusercontent.com/X1S7UllJ3QhuitOZkPPDzm9GvR_oh0MZafS1VP4cMpGRNfmg8TVDzDePguMRDbQ61VwLaHMK6B2UuYIX_s4xln0Yh756RcU8-x86y9ADBVkNqQdMyuUJPGG2Wo6VvSvgvVLOeGuV)

Choose <span class="emphasis">Permit all users to access this relying party</span>.

![](https://lh6.googleusercontent.com/_Dgqb5gnSjLRvtQKuIQ38K9wkVb97WYKFZXIiQb6OFAzlChmaFRNlH5H3J-YNS5h8j8it6BHfHADt88WfhCoUS3Keoz7lF0yxle5Q5eLgrZiW-zIn44xTj8Bq91ZqZCbZRet3fmw)

On the next step, just click <span class="emphasis">Next</span>.

![](https://lh3.googleusercontent.com/AX0Y9Y9a0Al-EQAgUkmNTSC-tTxJXVe0K1G2fBf9_ZofD5PPBD9wltrEo1A6Av-SvpJwQ_bUibkawPZSjL-YMmJcr99dAafyLG5mzpjLHLf8aM8wSx2kIy-fgsjmaa9FXPJo3pji)

On the final screen, check the box <span class="emphasis">Open the Edit Claim Rules dialog</span> and use the <span class="emphasis">Close </span>button to exit.

![](https://lh3.googleusercontent.com/ZS3_FXPmR5XFVIL4PE_wc5XczVkdUAtV17oG6Ed3qghwAdibKNFwmA8pISzu0ZUDoEvST2PA4NDgK_wLCb_T0fAe9ljGu7371dU6pl98sPStlZ8XXfB7cH1rH_1hY8w__O2lR6s1)

## Step 6. Creating Claims Rules

<div class="support-faqs__text support-faqs__text-block" id="bkmrk-add-the-first-rule-s">1. Add the first rule
    
    ![](https://lh4.googleusercontent.com/ZUjVMXbGp0OoUkrJbpP90Tbgdx0vhmO6okP5lNz5kHXPxFqZ8zXCP22BK-mP0oYJKT3e0q4T1Al7pVMXfVh0yWS4JjLAxPNtZTBPvFl0ehW3i_Rp5s3unX6l1FgmhHdIXBtLRp-t)
2. Select <span class="emphasis">Send LDAP Attributes as Claims</span>
    
    ![](https://lh4.googleusercontent.com/PfGJ2OSpACIm1nBtinVxH-hRr2IX7JsiG8V0wOASvZzD_5ohgTa5uQk3jFRwr9V8KcsIBSwBpNGBniGTAZppjLKzdoeX9TfiI-1EsSh1Od-J0GQJZ16GS_wdTNtNxmN9guIpXqFX)
3. On the next screen, specify your Claim Rule, for Example <span class="emphasis">E-mail to Learn</span>, using <span class="emphasis">Active Directory </span>as your attribute store, and do the following:
    
    
    - Fr om the <span class="emphasis">LDAP Attribute</span> column, select <span class="emphasis">E-Mail Addresses</span>
    - Fr om the <span class="emphasis">Outgoing Claim Type</span>, enter “<span class="emphasis">email</span>”
        
        ![](https://lh5.googleusercontent.com/cbshGH1pmCu-u_um9H9JSU9MicGTn1jaoESRcZbqGhYy_wDAWT5TLi-7xjBvnhtoZx7NVxYAiKfRP75JDHqsvbz14xdlMOY-lKqJjFPAunIzvprsw_CKyYmx0Xl4r15ybkBcqS8C)
    - Click on <span class="emphasis">Finish</span> or <span class="emphasis">OK</span> to save the new rule
4. After that, add the second rule and select <span class="emphasis">Transform an Incoming Claim</span> as the template
    
    ![](https://lh6.googleusercontent.com/Vldhqs282322jhhTUzugw7MZQzkKPrypE-UkoNmWx-D0X3cnlLQS2M6KVa82ORZ8ZFkPR9MjRRSmOUplUmKUoH7LFghGgLxAdzi0R3dibaaLAqKPHMktsl0mag69UfHzr7UoGN40)
    
    
    - Give your Claim Rule a title, for example, <span class="emphasis">Transform Account Name</span>
    - Select <span class="emphasis">Windows account name</span> as the <span class="emphasis">Incoming Claim Type</span>
    - Under <span class="emphasis">Outgoing Claim Type</span>, select <span class="emphasis">Name ID</span>
    - Under <span class="emphasis">Outgoing Name ID Format</span>, select <span class="emphasis">Transient Identifier</span>
    - Leave the default rule <span class="emphasis">Pass through all claim values</span>  
        ![](https://lh6.googleusercontent.com/J22FEWcG11f_f7Wta7PB0GepLEwafkUvUNuori6HE5SqEZqqiNS0HuTJ56PUaV-WiSsyUVHVAPops4QYROwUdRdl-cRofcp5sJByXNGIzySzB8Gx8ExjE_LGBZ9A-ZGEUr24XeBJ)
5. Finally, click on <span class="emphasis">OK</span> to create the claim rule, and then <span class="emphasis">OK</span> again to finish creating rules.

</div>## Step 7. Adjusting the Trust Settings

Some settings on your Relying Party Trust will need to be adjusted. To access these settings, select <span class="emphasis">Properties </span>from the <span class="emphasis">Actions </span>sidebar on the right while you have the <span class="emphasis">Relying Party Trust</span> selected.

<div class="support-faqs__text support-faqs__text-block" id="bkmrk-under-the%C2%A0advanced%C2%A0t">- Under the <span class="emphasis">Advanced </span>tab, make sure that the selection is <span class="emphasis">SHA-1</span>
    
    ![](https://lh3.googleusercontent.com/gNd4s8hFJrd4hzspladUgmtg60Q9bna6nn0O0q5TpNfkdwMr0dCftiWCFgT1mMPwQOg4BNuWQ8cMWYooUqIzaBwuiHiqLHxfF5ilVPUQVg9GQtekM2Wu5TuSYZMyZ6N-0tAnLp9x)
- Under the <span class="emphasis">Endpoints</span> tab, click <span class="emphasis">ADD </span>to add a new endpoint
- For the <span class="emphasis">Endpoint type</span>, select <span class="emphasis">SAML Assertion Consumer</span>
- For the <span class="emphasis">Binding</span>, choose <span class="emphasis">Artifact </span>with <span class="emphasis">Index 2</span>
- The <span class="emphasis">URL field</span> should look like this: [https://YourAccоuntURL.ispringlearn.com/module.php/saml/sp/saml2-acs.php/default-sp](https://xn--youraccunturl-o7k.ispringlearn.com/module.php/saml/sp/saml2-acs.php/default-sp)
- Leave the <span class="emphasis">Response URL</span> blank and click on OK
    
    ![](https://lh4.googleusercontent.com/gsGicTEDLYbI9F0K7iJIIWm_jmnD4rYS8dQeJDEM3ncvix3uMW4v1mWmEb5FKKkC3JKwNAFs9HfLpYDHUo-RzGwnbswTEZGyZ_0Yg_39NaI1cH-aCWozn9grLsyZ4iaX562BQM-X)
- Click <span class="emphasis">ADD </span>one more time
- For the <span class="emphasis">Endpoint type</span>, sele ct <span class="emphasis">SAML Logout</span>
- For the <span class="emphasis">Binding</span>, choose <span class="emphasis">POST</span>
- The <span class="emphasis">URL field</span> should look like this: [https://YОUR\_ADFS\_SERVERNAME.domail.local/adfs/ls/?wa=wsignout1.0](https://xn--yur_adfs_servername-qwp.domail.local/adfs/ls/?wa=wsignout1.0)
- Leave the <span class="emphasis">Response URL</span> blank and click on OK![](https://lh6.googleusercontent.com/gf1gpP3TETi2aIqvn79UxX2UY5Y8lxXS6bneJEpQMkBBKEAOq998XfDnZXm6Kd4FNgCBWknm-wEm1BAe6SHleOJwGXEsWvTEeiTSkePX2FH1yI0YKjcpK365zJ6045pfiXjwtvXk)

</div>## Step 8. Logging

Go to your SSO login page: [https://YourAccоuntURL.ispringlearn.com/sso/login](https://xn--youraccunturl-o7k.ispringlearn.com/sso/login) and enter your credentials.

Related Articles

- [Integrating iSpring Learn with your system: User Management and Single Sign On](https://www.ispringsolutions.com/articles/integration-of-ispring-learn-with-your-system)
- [SAML Technology for SSO](https://www.ispringsolutions.com/articles/saml-technology-for-sso "SAML Technology for SSO")
- [iSpring Learn SSO with Azure AD + SAML](https://www.ispringsolutions.com/articles/ispring-learn-sso-with-azure-ad-saml)