SSOGEN / Identity providers / SSO ADFS: Connect Microsoft AD FS to SSOGEN
Integration
SSO ADFS: Connect Microsoft AD FS to SSOGEN
SSO with ADFS works through SAML. SSOGEN is the service provider, AD FS is the identity provider, and SSOGEN's default attribute mapping already uses AD FS claim names.
SSO with ADFS keeps Microsoft Active Directory Federation Services as the place where employees authenticate. SSOGEN accepts the signed SAML assertion and turns it into access to every application it protects.
AD FS can run on your own servers or in Azure. SSOGEN is registered with it as a relying party, and people reach AD FS from the SSOGEN sign-in page.
SAML 2.0 and OpenID Connect applications accept that sign-in, and so do Oracle E-Business Suite, PeopleSoft and JD Edwards behind the SSOGEN Web Agent.
A standard SSO ADFS setup needs no mapping work, because SSOGEN’s default mapping was written for this case.
- Mail. The Mail assertion attribute defaults to the Microsoft
emailaddressclaim URI. - Display name. The Display name attribute defaults to the Microsoft
nameclaim URI.
These are the names AD FS and Entra ID send. See the SAML guide for every field.
What to set in AD FS
| Setting in AD FS | Value from SSOGEN |
|---|---|
| Relying party identifier | SP entity ID |
| Assertion consumer endpoint | ACS URL, HTTP-POST binding |
| Signing | The assertion must be signed |
| Name ID | A value that is stable for each person, such as the user principal name or email address |
| Claims | An email address, and a name if you want a display name |
Start the Add SAML Provider wizard first to get the three values you enter in AD FS. SSOGEN also publishes its own metadata at the SP metadata URL, which you can import if AD FS can read a file.
On-premises metadata and private networks
Most AD FS servers sit inside the corporate network. SSOGEN reads a Metadata URL from its own server, not from your browser.
- Private addresses are refused. SSOGEN refuses addresses that point into a private or reserved network. The wizard says “That host resolves to an address SSOGEN will not fetch from.”
- Upload the file. Download the AD FS federation metadata and choose Metadata file upload.
- The trade-off. You must upload the file again when AD FS replaces its signing certificate.
An administrator of the SSOGEN server can also limit which hosts it can fetch from. The message is “That host is not on the metadata fetch allow-list.”
How the person signs in at AD FS
- AD FS decides. It authenticates by Windows integrated authentication or a form, depending on its configuration.
- SSOGEN leaves the choice to AD FS.
- Strength is reported. The test result page reports the strength of the sign-in that AD FS achieved.
- Policy can require more. The sign-in policy of each application in SSOGEN can require more.
Errors and fixes
| Message | Fix |
|---|---|
| The assertion was addressed to a different service provider | The relying party identifier must equal the SP entity ID |
| The response came back to a different ACS URL | Fix the assertion consumer endpoint |
| The assertion’s signature did not verify | Import the federation metadata again |
| The assertion is outside its validity window | Check the clock on the AD FS server and on SSOGEN |
| A person signs in as a second account | The Name ID changed; use a stable one |
| A person signs in with no email | The claim rules do not issue the email claim |
Sign-out
- Turn on Also sign out of this provider on the provider’s page.
- Choose the IdP SLO URL from the metadata or a custom address.
Signing out of SSOGEN then ends the AD FS session too. Without it, the next page can sign the person straight back in.
After AD FS changes its certificate
When AD FS replaces its token-signing certificate, assertions stop verifying until SSOGEN holds the new one.
- With a Metadata URL. Edit the provider, fetch the metadata again and save a revision.
- With a file. Upload the new federation metadata.
- Then. Validate, Test and Activate the revision.
People keep signing in on the old configuration until you activate it, so do this before the old certificate expires. Test also warns when a signing certificate in the metadata has expired.
Questions people ask
Is AD FS the same as Entra ID?
No. AD FS runs in your own environment, and Entra ID is Microsoft’s cloud service. SSOGEN treats both as SAML providers, and both use the same default claim names.
Do I have to change SSOGEN’s mapping?
Usually no. If your claim rules use different attribute names, type the exact names into the Mapping step.
Where to go next
- Checklist. Read the SAML checklist.
- Providers. Compare providers on the hub.
- Cloud. See Microsoft Entra ID for the cloud equivalent.
- New to AD FS? Read what AD FS is and when to replace it.