Skip to main content

Create an OIDC federation for AD FS

  1. Set up the federation on the AD FS side.
  2. Create a federation on the Selectel side.
  3. Add the Selectel federation ID to the AD FS federation.
  4. If you enabled user provisioning when creating the federation on the Selectel side, set up user group mapping.

1. Set up the federation on the AD FS side

  1. On the AD FS server, open Server Manager.

  2. Right-click the Application Group section and select Add Application Group.

  3. On the Welcome step:

    3.1. In the Name field, enter the federation name.

    3.2. In the Templates section, select the Server application accessing a web template.

    3.3. Click Next.

  4. On the Server application step:

    4.1. Copy and save the value of the Client Identifier field.

    4.2. In the Redirect URI field, enter https://api.selectel.ru/v1/auth/federations/oidc/.

    4.3. Click Next.

  5. On the Configure Application Credentials step:

    5.1. Select the Generate shared secret checkbox. A secret will be generated.

    5.2. Click Copy to clipboard and save the secret value. It cannot be viewed later.

    5.3. Click Next.

  6. On the Apply Access Control Policy step:

    6.1. Select an access control policy.

    6.2. Click Next.

  7. On the Configure Application Permissions step:

    7.1. In the Permitted scopes section, select the checkboxes: email, openid, profile.

    7.2. Click Next.

  8. On the Summary step, click Next.

  9. On the Complete step, click Save.

2. Create a federation on the Selectel side

  1. In the control panel, in the top menu, click IAM.

  2. Go to the Federations section.

  3. Click Add federation and select OpenID Connect (OIDC).

  4. In the Federation settings block:

    4.1. Enter the federation name.

    4.2. Optional: enter the federation description.

    4.3. Change the session lifetime or leave the default value (24 hours). The session defines the time during which a user remains authorized without the need for re-authentication. You can specify a value from 1 to 720 hours.

  5. In the IDP settings block:

    5.1. In the IdP Issuer field, enter the identity provider ID — https://<idp_url>/adfs. Specify <idp_url> — your URL with the identity provider.

    5.2. In the Client ID field, enter the ID that you saved from the field Client Identifier when configuring the federation on the identity provider side in step 1 in step 4.1.

    5.3. In the Client Secret field, enter the secret, that you received when setting up the federation in step 1, sub-step 5.2.

    5.4. In the Auth URL field, enter the link to the identity provider's login page where users will be redirected for SSO authentication — https://<idp_url>/adfs/oauth2/authorize/. Specify <idp_url> — your URL with the identity provider.

    5.5. In the Token URL field, enter the token endpoint — https://<idp_url>/adfs/oauth2/token/. Specify <idp_url> — your URL with the identity provider.

    5.6. In the JWSK URI field, enter the certificate endpoint — https://<idp_url>/adfs/discovery/keys. Specify <idp_url> — your URL with the identity provider.

    5.7. To automatically create users when they first log in to the control panel via SSO, select the Automatically create users checkbox.

    If the checkbox is selected, you will need to configure user group mapping. Users will be created with the permissions you specify when configuring mapping. If you enable user auto-creation and do not configure mapping, users will be created without permissions and will not have access to the control panel.

    If you do not select the Automatically create users checkbox, you will need to add users manually.

  6. Click Create Federation.

3. Add the Selectel federation ID to the AD FS federation

  1. On the AD FS server, open Server Manager.
  2. In the Application Group section, open the federation that you set up on the AD FS side in step 1.
  3. In the Redirect URI field, enter https://api.selectel.ru/v1/auth/federations/oidc/<federation_id>/callback. Specify <federation_id> — the federation ID on the Selectel side, which can be found in the Control panel: in the top menu, click IAM → Federations → federation row → ID field.
  4. Click Save.

4. Set up user group mapping

Group mapping must be configured if you enabled user provisioning when creating the federation on the Selectel side in step 2. Use the Set up group mapping section of the User group mapping instructions.