Configure ADFS 3.0 with Sharepoint 2013

First you need to install ADFS server 3.0, if don’t know how, follow this tutorial http://blogit.create.pt/miguelmoreno/2014/11/14/installing-adfs-on-windows-server-2012-r2/

 

Configure relay party on ADFS

Start server manager, click on tools, AD FS Management.

On the right pane select Add Relying Party Trust.

 

Have the welcome to the wizard, click start button.

 

Select the option “Enter data about the relying party manually”

 

Specify Display Name

 

Use AD FS Profile

 

Click next

 

Select the option “Enable support for WS-Federation Passive Protocol” and insert the URL of the SharePoint Trust Service (ex. https://<sharepoint server FQDN>/_trust/)

 

Add the uniform resource name (URN) (is the historical name for a uniform resource identifier (URI)) of your SharePoint in the standard form urn:sharepoint:<Any string>.
In my case I have used urn:sharepoint:portal

 

Configure Multi-Factor Authentication Now – select “I do not want to configure …”

 

Select “Permit all users to access this relying party”

 

Review of the configuration, and click next.

 

---

 

Create the claim rule

After the configuration wizard the system automatically open the rule control windows and you need add some rule (Issuance Transform Rules) to complete the Claims token. SharePoint use EmailAddress for authentication so you add a rule to send User Principal Name as Email Address.

 

Create this rules:

Rule template: Pass Through or Filter an Incoming Claim

 

Claim rule name: Pass Through UPN
Incoming claim type: UPN
Pass through all claim values

 

I am not going to put images to all roles, but create more three.

Rule template: Pass Through or Filter an Incoming Claim
Calim rule name: Pass Through Primary SID (or something descriptive)
Incoming claim type: Primary SID
Pass through all claim values

Rule template: Transform an incoming Claim
Claim rule name: Transform Windows Account Name to Name
Incoming claim type: Windows account name
Outgoing claim type: Name (or *Name)
Pass through all claim values

Rule template: Send LDAP Attributes as Claims
Calim rule name: Send UPN as Email Address
Attribute store: Select “Active Directory”
“Mapping of LDAP attributes to outgoing claim types” select: LDAP Attribute: User-Principal-Name
Under Outgoing Claim Type: E-Mail Address

 

In AD FS Management, also export  the token-signing certificate. In the left pane click Services -> Certificates, right click in token-signing certificate and click view certificate.

 

Need to install certificate on this server and on sharepoint server.

Now you are going to export the certificate. Select details tab and click on Copy to File.

 

Choose the format “DER encoded binary X.509 (.CER)

 

Specify the name of the file.

 

 

Configure SharePoint 2013

 

First step is import the token-signing certificate on the SharePoint server. For do this you need to use the “SharePoint management shell”. First copy the exported certificate to the SharePoint server.
After that use the command:
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2(“<FullPathOfTheTokenSignCertFile>”)
New-SPTrustedRootAuthority -Name “Token Signing Cert” -Certificate $cert
After that register the claim provider in SharePoint:

$emailClaimMap = New-SPClaimTypeMapping -IncomingClaimType “http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress” -IncomingClaimTypeDisplayName “EmailAddress” -SameAsIncoming
$upnClaimMap = New-SPClaimTypeMapping -IncomingClaimType “http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn” -IncomingClaimTypeDisplayName “UPN” -SameAsIncoming
$roleClaimMap = New-SPClaimTypeMapping -IncomingClaimType “http://schemas.microsoft.com/ws/2008/06/identity/claims/role” -IncomingClaimTypeDisplayName “Role” -SameAsIncoming
$sidClaimMap = New-SPClaimTypeMapping -IncomingClaimType “http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid” -IncomingClaimTypeDisplayName “SID” -SameAsIncoming
$realm = “urn:sharepoint:portal”
$signInURL = “https://<ADFS Server>/adfs/ls”
$ap = New-SPTrustedIdentityTokenIssuer -Name “ADFS30” -Description “AD Federation Server” -realm $realm -ImportTrustCertificate $cert -ClaimsMappings

$emailClaimMap,$upnClaimMap,$roleClaimMap,$sidClaimMap -SignInUrl $signInURL -IdentifierClaim

$emailClaimmap.InputClaimType

 

Configure web application to use ADFS

 

Go to Central Administration -> Manage web applications and select the desired web application from the list. Select the Authentication Providers button and the desired SharePoint zone. Select the Trusted Identity Provider and the newly registered.

 

Enter in your web application, login with Windows authentication. Go to Site Setting -> Site Collections Administrators and add you domain email.

 

This post was based on some tutorials i have read

– http://lorson.wordpress.com/2014/08/15/configure-adfs-3-0-with-sharepoint-2013-for-claim-authentication/

– http://technet.microsoft.com/en-us/library/hh305235(v=office.15).aspx

– http://blogs.technet.com/b/speschka/archive/2010/07/30/configuring-sharepoint-2010-and-adfs-v2-end-to-end.aspx