{% capture givenname %}
### Rule 1
{% image sso/cheatsheets/saml-adfs/saml-adfs5.png %}
{% endcapture %}
{{ givenname | markdownify}}
{% capture surname %}
### Rule 2
{% image sso/cheatsheets/saml-adfs/saml-adfs6.png %}
{% endcapture %}
{{ surname | markdownify}}
{% capture email %}
### Rule 3
{% image sso/cheatsheets/saml-adfs/saml-adfs7.png %}
{% endcapture %}
{{ email | markdownify}}
### Get Certificate
In the left-hand file navigator, select **AD FS** → **Service** → **Certificates** to open the list of certificates. Select the **Token-signing** certificate, navigate to its **Details** tab, and select the **Copy to File...** button to export the Base-64 encoded token signing certificate:
{% image sso/cheatsheets/saml-adfs/saml-adfs8.png Get token-signing Certificate %}
You will need this certificate [during a later step](#identity-provider-configuration).
### Get Federation Service Identifier
In the left-hand file navigator, select **AD FS** and from the right-hand options menu select **Edit Federation Service Properties**. In the Federation Service Properties window, copy the **Federation Service Identifier**:
{% image sso/cheatsheets/saml-adfs/saml-adfs9.png Get Federation Service Identifier %}
You will need this identifier [during a later step](#identity-provider-configuration).
## Back to the Business Portal
At this point, you've configured everything you need within the context of the AD FS Server Manager. Jump back over to the Bitwarden Business Portal to complete configuration.
The Business Portal separates configuration into two sections:
- **SAML Service Provider Configuration** will determine the format of SAML requests.
- **SAML Identity Provider Configuration** will determine the format to expect for SAML responses.
### Service Provider Configuration
In the Service Provider Configuration section, configure the following fields:
|Field|Description|
|-----|-----------|
|Name ID Format|Select the **Outgoing Name ID Format** selected when constructing [Claims Issuance Rules](#edit-claim-issuance-rules) (see **Rule 3**).|
|Outbound Signing Algorithm|The algorithm Bitwarden will use to sign SAML requests.|
|Signing Behavior|Whether/when SAML requests will be signed.|
|Minimum Incoming Signing Algorithm|By default, AD FS will sign with SHA-256. Select **SHA-256** from the dropdown unless you've [configured AD FS to use different algorithm](#hash-algorithm).|
|Want Assertions Signed|Whether Bitwarden expects SAML assertions to be signed.|
|Validate Certificates|Check this box when using trusted and valid certificates from your IdP through a trusted CA. Self-signed certificates may fail unless proper trust chains are configured within the Bitwarden Login with SSO docker image.|
When you're done with the Service Provider Configuration section, **Save** your work.
### Identity Provider Configuration
Identity Provider Configuration will often require you to refer back to the AD FS Server Manager to retrieve values:
|Field|Description|
|-----|-----------|
|Entity ID|Enter the retrieved [Federation Service Identifier](#get-federation-service-identifier). Please note, this **may not use HTTPS**.|
|Binding Type|By default, AD FS with use HTTP POST endpoint binding. Select **HTTP POST** unless you've [configured AD FS to use a different method](#endpoint-binding).|
|Single Sign On Service URL|Enter the SSO Service Endpoint. This value can be retrieved from the **Service** → **Endpoints** tab in AD FS Manager and by default should begin with `http://` and end with `/adfs/services/ls`.|
|Artifact Resolution Service URL|Only use this field if you have selected **Artifact** as the [endpoint binding method](#endpoint-binding) of your Relying Party Trust.|
|X509 Public Certificate|Paste the downloaded certificate, removing `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`.