Single sign-on with Microsoft ADFS

1. Open ADFS Management with administrator rights.
2. Go to Relying Party Trusts and click Add Relying Party Trust.
3. Choose Claims aware, then click Start.
4. On Select Data Source, choose Enter data about the relying party manually, then enter a display name (for example Zefi).
5. On Configure Certificate, skip the step: Zefi does not use encrypted assertions.
6. Fill in the remaining settings:
   
   1. Configure URL: tick Enable support for the SAML 2.0 WebSSO protocol and paste the Single sign-on URL (ACS URL) shown in the Zefi platform.
   2. Configure Identifiers: add the Audience URI (SP Entity ID) shown in the Zefi platform, exactly as it appears.
   3. Choose Access Control Policy: Permit specific group (for example a Zefi users group) or Permit everyone.
   4. Finish, with Configure claims issuance policy for this application ticked.
7. Set up sign-out: ask your Zefi contact for the Zefi signing certificate, then open the trust's Properties and add the certificate on the Signature tab.
8. On the Endpoints tab, add a SAML Logout endpoint with binding POST and trusted URL https://eu.auth.zefi.ai/saml2/logout (the Single sign-on URL with idpresponse replaced by logout). Without it, sign-in works but signing out shows an ADFS error page.

1. Zefi reads three attributes with these exact, case-sensitive names: email, firstName and lastName. ADFS sends long URI names by default, which Zefi does not read, so type the names by hand instead of picking them from the list.
2. Open Edit Claim Issuance Policy on the Zefi trust and click Add Rule.
3. Rule 1: choose Send LDAP Attributes as Claims, attribute store Active Directory, and add these rows (LDAP attribute -> outgoing claim type):
   
   1. E-Mail-Addresses -> email (type it), plus a second row E-Mail-Addresses -> E-Mail Address (pick it from the list; rule 2 uses it)
   2. Given-Name -> firstName (type it)
   3. Surname -> lastName (type it)
4. Rule 2: choose Transform an Incoming Claim, with incoming claim type E-Mail Address, outgoing claim type Name ID and name ID format Email. Without it, ADFS sends no Name ID and Zefi rejects the sign-in. Users with no email address (mail attribute) in Active Directory can't sign in.

Export the metadata from ADFS

1. Download the federation metadata file from https://<your-adfs-host>/FederationMetadata/2007-06/FederationMetadata.xml and save it as an .xml file.
2. You can give Zefi that URL instead only if it is reachable from the public internet. Most ADFS servers are internal, so uploading the file is usually the way.
3. ADFS renews its token-signing certificate automatically, usually once a year. Each time it changes, upload the new metadata file in Zefi, or sign-ins will stop working.

Configure your Zefi account to connect with ADFS

1. In the Zefi platform, go to Settings -> Security -> SAML Single Sign-On and turn on Enable SAML authentication.
2. Under Identity Provider Metadata, choose File upload, select the metadata file and save.
3. Ask your Zefi contact to link your company email domain, so that typing a work email on the Zefi login page takes users to ADFS. Until then, users sign in with the Start URL shown in Settings -> Security.
4. Test: in a private browser window, open the Start URL, sign in on the ADFS page and check that you land in Zefi. Then sign out and check that you are back on the Zefi login page.
5. Sign-in must start from Zefi (the login page or the Start URL). Starting from the ADFS sign-in portal is not supported.