Steps: Configure SAML SSO Using MS-AD FS 3.0

Prerequisites

A computer that:
Has Windows Server 2008 R2 or RelayState parameter enabled. See
MS AD FS 3.0 RelayState
for more information.
Is included within a domain
An
Adaptive Planning
account with administrative permissions
A confirmation email from
Adaptive Planning
stating that SAML has been provisioned on your instance
A certification authority verified token signing certificate

Go to
MS AD FS Management Consol > Service > Certificates.
In the certificates list, right-click
Token-Signing
, and
then click
View Certificate.
Go to the
Details
tab and click
Copy to File...
When the
Certificate Export Wizard
appears, click
Next.
Select
DER encoded binary X.509 (.cer),
and click
Next.
Select a directory to save the file, name it, and click
Next.
Click
Finish.

MS AD FS 3.0 RelayState

For ADFS 3.0, open the following file in Notepad:
%systemroot%\ADFS\Microsoft.IdentityServer.Servicehost.exe.config
In the
microsoft.identityServer.web
section, add a line for
useRelayStateForIdpInitiatedSignOn
as follows, and save the change:
<microsoft.identityServer.web>
...
<useRelayStateForIdpInitiatedSignOn enabled="true" />
</microsoft.identityServer.web>
Save the file.
Restart the Active Directory Federation Services (adfssrv) service.

Configuring

Adaptive Planning

as a Relying Party

Navigate to the MS AD FS 3.0 Management console.
Click
MS AD FS 3.0
and expand
Trust Relationships
.
Right-click
Relying Party Trusts
and click
Add Relying Party Trust.
On the Select Data Source page, select
Enter data about the relying party manually
, and click
Next.
Specify any appropriate name for the display name. Example: AdaptivePlanning. Enter the notes if any and click
Next
.
Select
AD FS profile.
Skip the Configure Certificate step.
Set up the
Adaptive Planning
SSO URL which you will get from the SAML Settings screen in
Adaptive Planning
. Example:
https://login.adaptiveplanning/samlsso/R0xPQk8==
On the
Configure Identifiers
page, enter
the URL from the SAML Settings screen in
Adaptive Planning
as the identifier and click
Add.
On the next page, select
Permit all users access to this relying party
(select
Deny
if you want to assign this application to specific users later) and click
Next.
On the
Ready to Add Trust
page, click
Next.
On the
Finish
page, clear
Open the Edit Claims Rules dialog for this relying party trust when the wizard closes,
and click
Close.

Configuring Claim Rules

Sample Claim Rule #1

In this claim rule, the

Email-Address

value of a user will be sent as an attribute statement in the SAML response. You can use any LDAP attribute in the SAML token as long as that attribute uniquely identifies each user. Similarly, for the Outgoing Claim Type, choose one from the list or type in the name.

Right-click the
AdaptivePlanning
entry in the
Relying Party Trusts
list and select
Edit Claim Rules.
Click
Add Rule
from the
Issuance Transform Rules
tab.
Select
Send LDAP Attribute as Claims
from
Claim Rule
template drop-down.
Click
Next.
Give the claim a name like
Email as Claim.
Set the
Attribute Store
field to Active Directory, the
LDAP Attribute
to Email-Addresses, and the
Outgoing Claim Type
to Email Address.
Click
Finish
.
SAML attribute:
If you configured only one Claim Rule #1, then to enter Outgoing Claim Type from Claim Rule #1.
To find the Outgoing Claim type, go to ADFS Management console.
Click on Service > Claim Descriptions
Right click on Claim type you are using and click properties.
Copy the value in
Claim Type
and paste in the SAML attribute name. It might look like "
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
" or the short name that you might have typed.

Sample Claim Rule #2

In this claim rule, we will send the email address configured in Claim Rule #1 as the

NameID

of the subject.

Click
Add Rule.
Select
Transform an Incoming Claim
as the claim rule template to use.
Give it a name. In this example, we are using
Email Address to Name ID.
The incoming claim type should be
E-mail Address (
OR it must match the outgoing claim type used in Sample Claim Rule #1).
Set
Outgoing claim type
to
Name ID
and
Outgoing name ID format
to
Email.
Select
Pass through all claim values.
Click
Finish.

This rule will send the E-mail-Address value of a user as the NameID of the subject with the format

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

.

Setting up MS AD FS as Identity Provider in

Adaptive Planning

Log in to your Adaptive Planning instance as a user with User Administrator permissions.
Go to
Admin > SAML SSO Settings.
Enter the following settings:
Identity provider name
:
Enter your MS AD FS 3.0 server name here.
Identity provider Entity ID
:
Enter the value found on the FS Server MS AD FS 3.0 Management Console. To find this, right-click
Service,
click
Edit Federation Services Properties
, and copy the value from
Federation Service Identifier
field.
Identity provider single sign-on URL:
Enter the URL similar to (this is the URL from MS AD FS side to directly log in to Adaptive Planning):
https://ADFS_HOST/adfs/ls
Custom logout URL
: Optional. Enter a URL to load when the user clicks
Logout
from Adaptive Planning. If a URL is not specified, the Adaptive Planning login page is used.
Identity Provider Certificate:
Select the certificate file described in the Prerequisites.
SAML user ID type
: Select the user's federation ID. If you set up your claim rule to use the user's email address and that address is the same as the login field on the user's profile, you can select
User's Adaptive Planning user name for SAML User ID.
SAML user ID location
:
If you only configured Sample Claim Rule #1 in the claim rules of the relying party, then select
User ID in Attribute.
If you configured Sample Claim Rule #2, then select
User ID
for
NameID of Subject.
SAML attribute
and
SAML NameID format:
You only need to enter one of these. If you only configured Sample Claim Rule #1, fill in the SAML attribute field with the outgoing claim type from Sample Claim Rule #1 and leave the
SAML NameID
format field blank. If you configured both sample claim rules, you can skip the
SAML attribute
field and fill in the
SAML NameID
field with the outgoing name ID format from Sample Claim Rule #2 (Email).
Enable SAML
:
Select
Not Enabled
(this is the default value). After testing the configuration, return to this screen and enable SAML for other users.
Click
Save.
The Admin overview displays.
Go back to the
SAML SSO Setting
s page to verify that the settings were saved successfully. Verify the issuer and validity of the identity provider certificate.
Look for Adaptive Planning
SSO URL
at the bottom of the page, and copy the entire string value. Save this value as you will need it in the next section.

Completing the Configuration of the MS AD FS Relying Party

Navigate back to your MS AD FS 3.0 administration console.
Right-click
AdaptivePlanning
in the
Relying Party Trusts
list and select
Properties.
Click the
Endpoints
tab and click
Add.
Set
Endpoint Type
to
SAML Assertion Consumer
.
Set
Binding
to
POST.
Paste the value of the Adaptive Planning SSO URL into the
URL
field. Note that you copied the URL in the step
Setting up MS AD FS as Identity Provider in Adaptive Planning
.
Click
OK
and click
Apply
in the properties dialog.

Testing the Setup

Select a user on the MS AD FS side and the Adaptive Planning side. The
Adaptive Planning
user must have a SAML Admin permission.
Enter the email address (or the LDAP attribute selected in Claim Rule #1) in MS AD FS for that user.
From Adaptive Planning, enter the email address (possibly the same value) in the
SAML Federation ID
field for the user on the
Admin > Edit User
page.
Log that AD FS user into a computer that is part of the Active Directory domain.
Within a web browser on that computer, visit
https://login.adaptiveplanning.com/app
If your instance uses non-US based, regional authentication, then your authorization URLs and API endpoints vary based on your region. See Reference: Regional Authentication URLs.
If everything is configured correctly, you will be redirected to the Adaptive Planning welcome page. Enter the username but leave the password field blank on the login page. Click
Submit
.

SSO Into Excel Interface for Planning and OfficeConnect