Steps: Configure SAML SSO Using MS-AD FS 2.0

Prerequisites

A machine that:
Has Windows Server 2008 R2 and AD FS 2.0 installed.
Has the AD FS 2.0 Rollup 2 hotfix installed and the usage of the
RelayState
parameter enabled. See The AD FS 2.0 Rollup 2 Hotfix for more.
Is included within a domain.
An
Adaptive Planning
account with administrative permissions.
A confirmation email from
Adaptive Planning
stating that you've provisioned SAML on your
Adaptive Planning
instance.
A certification authority verified token signing certificate.

Go to
MS AD FS Management Console > Service > Certificates
.
In the
Certificates
list, right-click
Token-Signing
and click
View Certificate
.
Go to the
Details
tab and click
Copy to File
.
When the
Certificate Export Wizard
displays, click
Next
.
Select
DER encoded binary X.509 (.cer)
, and click
Next
.
Select a directory to save the file and give it a name, and click
Next
.
Click
Finish
.

The AD FS 2.0 Rollup 2 Hotfix

If you haven’t already installed the hotfix, go here:

http://support.microsoft.com/kb/2681584

After installing the hotfix, enable the usage of the RelayState parameter in the Identity-provider-initiated SSO:

Open the
inetpub\adfs\ls\web.config
file in an editor.
Locate the section beginning with
<microsoft.identityServer.web>
Add this line to that section:
<useRelayStateForIdpInitiatedSignOn enabled="true" />
Save the file.

Configure

Adaptive Planning

As a Relying Party

Navigate to the AD FS 2.0 Management console.
Click
AD FS 2.0
and expand
Trust Relationships
.
Right-click
Relying Party Trusts
and click
Add Relying Party Trust
.
On the
Select Data Source
page, select
Enter data about the relying party manually
, and click
Next
.
Specify any appropriate name for the display name. Example: AdaptivePlanning. Enter the notes if any and click
Next
.
Select
AD FS 2.0 Profile
.
Skip the Configure Certificate step.
Set up the
Adaptive Planning
SSO URL, which you’ll get from the SAML Settings page. Example:
https://login.adaptiveplanning.com:443/samlsso/VkdHUkVFTkNPQURGUoMzNA==
On the
Configure Identifiers
page, enter the URL from the SAML Settings page in
Adaptive Planning
as the identifier and click
Add
.
On the next page, select
Permit all users access to this relying party.
Select
Deny
if you want to assign this application to specific users later and click
Next
.
On the
Ready to Add Trust
page, click
Next
.
On the
Finish
page, clear
Open the Edit Claims Rules dialog for this relying party trust when the wizard closes
, and click
Close
.

Configuring Claim Rules

Sample Claim Rule #1

In this claim rule, the

Email-Address

value of a user is sent as an attribute statement in the SAML response. You can use any LDAP attribute in the SAML token as long as that attribute uniquely identifies each user. Similarly, for the Outgoing Claim Type, select one from the list or type in the name.

Right-click the
AdaptivePlanning
entry in the
Relying Party Trusts
list and select
Edit Claim Rules
.
Click
Add Rule
from the
Issuance Transform Rules
tab.
Select
Send LDAP Attribute as Claims
from
Claim Rule
template drop-down.
Click
Next
.
Give the claim a name like
Email as Claim
.
Set the
Attribute Store
field to
Active Directory
, the
LDAP Attribute
to
Email-Addresses
, and the
Outgoing Claim Type
to
Email Address
.
Click
Finish
.

Sample Claim Rule #2

In this claim rule, we’ll send the email address configured in Claim Rule #1 as the

NameID

of the subject.

Click
Add Rule
.
Select
Transform an Incoming Claim
as the claim rule template to use.
Give it a name. In this example, we’re using
Email Address to Name ID
.
The incoming claim type should be
E-mail Address
(OR it must match the outgoing claim type used in Sample Claim Rule #1).
Set
Outgoing claim type
to
Name ID
and
Outgoing name ID
format to
Email
.
Select
Pass through all claim values
.
Click
Finish
.

This rule will send the E-mail-Address value of a user as the NameID of the subject with the format

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

.

Setting Up AD FS as Identity Provider In

Adaptive Planning

Sign in to your
Adaptive Planning
instance as a user with User Administrator permissions.
Go to
Admin > Manage SAML SSO Settings
.
Enter these settings:
Identity provider name:
Enter your AD FS 2.0 server name here.
Identity provider Entity ID:
Enter the value found on the FS Server AD FS 2.0 Management Console. To find this, right-click
Service
, click
Edit Federation Services Properties
, and copy the value from
Federation Service Identifier
field.
Identity provider single sign-on URL:
Enter the URL from MS AD FS side to log in directly to
Adaptive Planning
similar to:
https://ADFS_HOST/adfs/ls
.
Custom log out URL
:
Optional. Enter a URL to load when the user clicks Logout from
Adaptive Planning
. If you don't specify a UR, the
Adaptive Planning
sign-in page is used.
Identity Provider Certificate:
Select the certificate file included in Prerequisites.
SAML user ID type
:
Select the user federation ID. If you set up your claim rule to use the user email address and that address is the same as the login field on the user profile, select
User's
Adaptive Planning
user name
for
SAML User ID.
SAML user ID location
: If you only configured Sample Claim Rule #1 in the claim rules of the relying party, then select User ID in Attribute. If you configured Sample Claim Rule #2, then select
User ID
for
NameID of Subject.
SAML attribute
and
SAML NameID format:
You only need to enter one of these:
If you only configured Sample Claim Rule #1, fill in the
SAML attribute
field with the outgoing claim type from Sample Claim Rule #1. Leave the SAML NameID format field blank.
If you configured both sample claim rules, skip the
SAML attribute
field and fill in the
SAML NameID
field. Use the outgoing name ID format from Sample Claim Rule #2 (Email).
Enable SAML
: Select Not Enabled (this is the default value). After testing the configuration, return to this page and enable SAML for other users.
Click
Save.
The
Adaptive Planning
Admin Overview page will load.
Look for
Adaptive Planning
SSO URL
at the bottom of the page, and copy the entire string value. Save this value as you’ll need it in the next section. Example:

https://login.adaptiveplanning.com:443/samlsso/VkdHUKVFTkNPQURGU0MzNA--

Complete the Configuration of the AD FS Relying Party

Navigate back to your AD FS 2.0 administration console.
Right-click
AdaptivePlanning
in the
Relying Party Trusts
list and select
Properties
.
Click the
Endpoints
tab and click
Add
.
Set
Endpoint Type
to
SAML Assertion Consumer
.
Set
Binding
to
POST
.
Paste the value of the
Adaptive Planning
SSO URL, which you copied in Step 6 of Setting up MS AD FS as Identity Provider in Adaptive Planning, into the
URL
field.
Click
OK
and click
Apply
in the properties dialog.

Test the Setup

Select a user on the AD FS and on
Adaptive Planning
. The
Adaptive Planning
user must have SAML Admin permission.
Enter the email address (or the LDAP attribute selected in Claim Rule #1) in AD FS for that user.
From
Adaptive Planning
, enter the email address in the
SAML Federation ID
field for the user on the
Administration > Users
page and click
Submit
.
Log that AD FS user into a computer that is part of the Active Directory domain.
Within a web browser on that computer, go to
https://login.adaptiveplanning.com/app
If your instance uses non-US based, regional authentication, then your authorization URLs and API endpoints vary based on your region. See Reference: Regional Authentication URLs.
If you configured everything correctly, you're redirected to the
Adaptive Planning
welcome page. Enter the username but leave the password field blank on the sign-in page. Click
Submit
.

SSO Into Excel Interface for Planning and OfficeConnect