Configure SSO with AD FS
Before you begin — Read SSO Integration: How It Works first. The email claim you emit must equal each user's Sfax Username.
Add a Relying Party Trust for Sfax with the following endpoints and identifier.
| AD FS setting | Value |
|---|---|
| Relying party identifier (Entity ID) | https://app.sfaxme.com/ |
| SAML Assertion Consumer endpoint (POST) | https://app.sfaxme.com/sso/sso.aspx |
| SLO endpoint | https://app.sfaxme.com/sso/slo.aspx |
Claim Rules
- Send LDAP Attributes as Claims - map E-Mail-Addresses → E-Mail Address.
- Transform an Incoming Claim - map E-Mail Address → Name ID, with Outgoing name ID format = Email.
Plan for automatic certificate rollover — AD FS renews its token-signing certificate automatically by default (AutoCertificateRollover). After a rollover the new certificate must be re-entered in Sfax Manage SSO, or SSO will break for all users. Track your AD FS certificate expiry and update Sfax when it changes.
Common Pitfalls
- Emitting the UPN as the Name ID when it differs from the user's email.
- Configuring the relying party trust not to sign the assertion - the assertion must be signed (AD FS signs it by default).
- Missing the certificate update after an AD FS cert rollover.