Single sign-on with AD FS

This guide explains how to set up Microsoft Active Directory Federation Services (AD FS) as an SAML IdP using Split's SAML 2.0 API, allowing users to log in to Split using their single sign-on (SSO) credentials. Learn more about configuring SAML in Split.

Configure SAML

If you are a Split administrator, you can configure SAML in the Security section of Admin Settings.

1. Go to Admin Settings > Security > SAML.
2. Add your IdP metadata to the text area.
3. Enable/disable SAML strict mode.
4. Enable/disable just-in-time user provisioning.
5. Click Save.

When you save these changes, you can view the summary of the SAML configuration parameters. You use these settings in Okta.

Add relying trust party

1. Open the AD FS management console by going to the Server Manager console and selecting AD FS Management from the Tools list (on the right).

2. Click Required: Add a trusted relying party.

3. A walk-through opens to assist you in adding a new relying party trust to the AD FS configuration database. Read the instructions and click Next.
4. Select Import data about the relying part from a file.
5. Click Browse to select the metadata file then click Next.

6. Provide a display name for the Trust, for example, Split, and then click Next.

7. Select Permit all users to access this relying party, and then click Next.

8. Review the settings, and then click Next.

9. Click Close. This saves the trust and opens the Edit Claim Rules.

We recommend two claim rules for brokering the SAML assertions. Follow the steps below to configure.

10. Click Add Rule.

11. Select Send LDAP Attributes as Claims, and then click Next.

12. Configure the rule as follows. When all settings are configured, click Finish.

    • Set the Claim rule name as NameID.
    • Set the Attribute store as Active Directory.
    • Set the LDAP Attribute as User-Principle-Name.
    • Set the Outgoing Claim Type as E-Mail Address.

13. Add the second rule by clicking Add Rule.
14. Select Transform an Incoming Claim, and then click Next.

15. Configure the rule as follows. When all settings are configured, click Finish.
    • Set the Claim rule name as Email Claim.
    • Set the Incoming claim type as E-Mail Address.
    • Set the Outgoing claim type as Name ID.
    • Set the Outgoing name ID format as Email.

16. Right-click the properties of the relying party trust and select the Advanced tab.
    17.Select SHA-1 for the Secure hash algorithm, and then click Apply.

Split is now set up with AD FS.