From 84119f13a783b2dba2fa57f76a7ab53a25bfa790 Mon Sep 17 00:00:00 2001 From: fred_the_tech_writer <69817454+fschillingeriv@users.noreply.github.com> Date: Thu, 22 Jul 2021 15:25:22 -0400 Subject: [PATCH] ADFS SSO Article (#683) * update of adfs sso doc (#680) * small fixes --- _articles/login-with-sso/saml-adfs.md | 155 ++++++++++++++++-- .../sso/cheatsheets/saml-adfs/saml-adfs3.png | Bin 39196 -> 60320 bytes .../sso/cheatsheets/saml-adfs/saml-adfs4.png | Bin 58207 -> 87450 bytes .../sso/cheatsheets/saml-adfs/saml-adfs8.png | Bin 206096 -> 193851 bytes .../sso/cheatsheets/saml-adfs/saml-adfs9.png | Bin 58594 -> 83930 bytes 5 files changed, 144 insertions(+), 11 deletions(-) diff --git a/_articles/login-with-sso/saml-adfs.md b/_articles/login-with-sso/saml-adfs.md index 23cc4c9f..01364554 100644 --- a/_articles/login-with-sso/saml-adfs.md +++ b/_articles/login-with-sso/saml-adfs.md @@ -1,40 +1,173 @@ --- layout: article title: ADFS SAML Implementation -categories: [] +categories: [login-with-sso] featured: false popular: false hidden: true tags: [sso, saml, adfs] order: --- +This article contains **Active Directory Federation Services (AD FS)-specific** help for configuring Login with SSO via SAML 2.0. For help configuring Login with SSO for another IdP, refer to [SAML 2.0 Configuration]({{site.baseurl}}/article/configure-sso-saml/). -This article contains sample configurations for Bitwarden **Login with SSO** (SAML 2.0) implementations with ADFS. +Configuration involves working simultaneously within the Bitwarden [Business Portal]({{site.baseurl}}/article/about-business-portal/) and the AD FS Server Manager. As you proceed, we recommend having both readily available and completing steps in the order they're documented. -Use this as reference material for the [Configuring Login with SSO (SAML 2.0)]({% link _articles/login-with-sso/configure-sso-saml.md%}) article. +## Open the Business Portal -## ADFS Client Application +If you're coming straight from [SAML 2.0 Configuration]({{site.baseurl}}/article/configure-sso-saml/), you should already have an [Organization ID created]({{site.baseurl}}/article/configure-sso-saml/#step-1-enabling-login-with-sso) and the SSO Configuration screen open. If you don't, refer to that article to create an Organization ID and open your Business Portal to the SSO Configuration section: -The following is a sample SAML 2.0 implementation with Bitwarden in the ADFS client application: +{% image sso/sso-saml1.png SAML 2.0 Configuration %} -{% image sso/cheatsheets/saml-adfs/saml-adfs2.png %} +You don't need to edit anything on this screen yet, but keep it open for easy reference. -{% image sso/cheatsheets/saml-adfs/saml-adfs3.png %} +## Create a Relying Party Trust + +In the AD FS Server Manager, select **Tools** → **AD FS Management** → **Action** → **Add Relying Party Trust**. In the Wizard, make the following selections: + +1. On the Welcome screen, select **Claims Aware**. +2. On the Select Data Source screen, select **Enter data about the relying party manually**. +3. On the Specify Display Name screen, enter a Bitwarden-specific display name. +4. On the Configure URL screen, select **Enable support for SAML 2.0 WebSSO protocol**. + + - In the **Relying party SAML 2.0 SSO service URL** input, enter the Assertion Consumer Service (ACS) URL retrieved from the Bitwarden SSO Configuration screen. + + For Cloud-hosted customers, this is always `https://sso.bitwarden.com/saml2/your-org-id/Acs`. For self-hosted instances, this is determined by your [configured Server URL]({{site.baseurl}}/article/install-on-premise/#configure-your-domain), for example `https://your.domain.com/sso/saml2/your-org-id/Acs`. + 6. On the **Choose Access Control Policy** screen, select the +5. On the **Configure Identifiers** screen, add the SP Entity ID (retrieved from the Bitwarden SSO Configuration screen) as a relying party trust identifier. + + For Cloud-hosted customers, this is always `https://sso.bitwarden.com/saml2`. For self-hosted instances, this is determined by your [configured Server URL]({{site.baseurl}}/article/install-on-premise/#configure-your-domain), for example `https://your.domain.com/sso/saml2`. +6. On the **Choose Access Control Policy** screen, select the desired policy (by default, **Permit Everyone**). +7. On the **Ready to Add Trust** screen, review your selections. + +### Advanced Options + +Once the Relying Party Trust is created, you can further configure its settings by selecting **Relying Party Trusts** from the left-hand file navigator and selecting the correct display name. + +#### Hash Algorithm + +To change the **Secure hash algorithm** (by default, SHA-256), navigate to the **Advanced** tab: + +{% image sso/cheatsheets/saml-adfs/saml-adfs3.png Set a Secure Hash Algorithm %} + +#### Endpoint Binding + +To change the endpoint **Binding** (by default, POST), navigate to the **Endpoints** tab and select the configured ACS URL: {% image sso/cheatsheets/saml-adfs/saml-adfs4.png %} +### Edit Claim Issuance Rules + +Construct Claim Issuance Rules to ensure that the appropriate claims, including Name ID, are passed to Bitwarden. The following tabs illustrate a sample ruleset: + +
+usu$hG(_18Q5B1*ji>+BfL+Jz=e$i
zuDu7$38mXtmqJZ29KTt^i6!F~6;w`%jG$F8U(2qYnb33M39dB+3APEb1iE*oU
rP(7oy9xx+{+LqR{$;X)p_E&a5M#%10cm
z-L8E)IqMubqqW1H0t*|4kW6b{(8WTpP{Ju+=cb(U47RE%=rR4x!MSr;cu^4aa1htw
zAs1ARt6$$Svq=5K&S3J1-b8=t9
zOU9?^3chl(9uQ6<{M>~P%ip8m@ehZ1AD3f!BO)Uoy1G(cPETiIX0E?ds}UJ*6WM?5
ze*-5c8{F)R!k6hmh{LDr1GcKCHU1sA4EzTDCE-;I5RWz=#V-WrX)xoDz(yx8K*7_=
z>!|yW^Zrij$qE5zI5ns}ejdN`(&JUeu!`#YY`W`kz-!fI4L
zoKjBFo}G!AnW{sbI