---
title: "Create a SAML federation for AD FS"
sidebar_label: "Create a SAML federation for AD FS"
sidebar_position: 2
description: "How to configure a federation on the Selectel side and the AD FS identity provider side using the SAML protocol"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import CreateFederationForSelectel from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/access-control/federations/manage-saml/create-federation-for-selectel.mdx'

# Create a SAML federation for AD FS

:::info

This instruction describes how to configure AD FS based on Windows Server 2019. The steps may differ for other versions.

:::

Active Directory Federation Services (AD FS) must be configured in accordance with Microsoft recommendations for deploying AD FS clusters and proxy servers.

1. If you do not have a certificate issued by AD FS, [issue it](#issue-certificate).
2. [Create a federation on the Selectel side](#create-federation-for-selectel).
3. [Configure relying party trust](#configure-relying-party-trust).
4. If, when creating a federation on the Selectel side, you checked the **Sign authentication requests** checkbox, [upload a certificate for signing requests](#upload-certificate).
5. [Configure Claims Mapping](#configure-claims-mapping).
6. If, when creating a federation on the Selectel side, you enabled user auto-creation, [configure user group mapping](#configure-mapping).

### 1. Issue a certificate \{#issue-certificate}

Issue a certificate on the AD FS side; for more details, see the [Certificates](/access-control/federations/manage-saml/certificates.mdx) instruction.

You can create a federation without a certificate and add it later, but the federation will not work without a certificate.

## 2. Create a federation on the Selectel side \{#create-federation-for-selectel}

<CreateFederationForSelectel IdIssuer="http://<idp_url>/adfs/services/trust" Link="https://<idp_url>/adfs/ls" />

## 3. Configure relying party trust \{#configure-relying-party-trust}

1. On the AD FS server, open **Server Manager**.

2. In the **Tools** menu, select **AD FS Management**.

3. In the **Actions** block, select **Relying Party Trust** → **Add Relying Party Trust**.

4. At the **Welcome** stage:

   4.1. Select **Claims aware**.

   4.2. Click **Start**.

5. At the **Select Data Source** stage:

   5.1. Select **Enter data about the relying party manually**.

   5.2. Click **Next**.

6. At the **Specify Display Name** stage:

   6.1. In the **Display name** field, enter a name for the relying party trust.

   6.2. Click **Next**.

7. At the **Configure Certificate** stage:

   7.1. If you checked the **Sign authentication requests** checkbox when creating a federation on the Selectel side, [download the certificate for signing requests](/access-control/federations/manage-saml/certificates.mdx#download-certificate-for-request-verification) and insert it.

   7.2. Click **Next**.

8. At the **Configure URL** stage:

   8.1. Select the **Enable support for the SAML 2.0 WebSSO protocol** checkbox.

   8.2. In the **URL** field, enter the address to which users will be redirected after authentication — `https://api.selectel.ru/v1/auth/federations/<federation_id>/saml/acs`. Specify `<federation_id>` — the federation ID on the Selectel side, which can be found in the [Control panel](https://my.selectel.ru/iam/federations): in the top menu, click **IAM** → **Federations** → federation row → field **ID**.

   8.3. Click **Next**.

9. At the **Configure Identifiers** stage:

   9.1. In the **URL** field, enter address — `https://api.selectel.ru/v1/federations/saml/<federation_id>`. Specify `<federation_id>` — the federation ID on the Selectel side, which can be found in the [Control panel](https://my.selectel.ru/iam/federations): in the top menu, click **IAM** → **Federations** → federation row → field **ID**.

   9.2. Click **Add** →  **Next**.

10. At the **Choose Access Control Policy** stage:

    10.1. Optional: specify who will have access to authentication via this federation. By default, the **Permit for everyone** policy is selected, which allows access for all users.

    10.2. Click **Next**.

11. At the **Ready to Add Trust** stage:

    11.1. Check the data.

    11.2. Click **Close**.

## 4. Download the certificate for signing requests \{#upload-certificate}

The certificate for signing requests must be uploaded if, when [creating a federation on the Selectel side at stage 2](#create-federation-for-selectel), you checked the **Sign authentication requests** checkbox.

1. On the AD FS server, open the **Service** → **Relaying Party Trust** folder.
2. Click on the created Relying Party Trust.
3. On the right, in the **Actions** section, in the block with the name of the created Relying Party Trust, click **Properties**.
4. Open the **Signature** tab.
5. Click **Add**.
6. Upload the certificate for signing requests that you downloaded when [configuring the relying party trust](#configure-relying-party-trust) at stage 7.1.

## 5. Configure Claims Mapping \{#configure-claims-mapping}

After successful authentication in AD FS, a SAML message will be sent to Selectel. To correctly identify the user, you must configure the mapping of user data to SAML message elements.

1. On the AD FS server, open the **Service** → **Relying Party Trusts** folder.

2. Right-click your Relying Party Trust and select **Edit Claim Issuance Policy**.

3. Click **Add Rule**.

4. At the **Choose Rule Type** stage:

   4.1. In the **Claim rule template** field, select **Send LDAP Attributes as Claims**.

   4.2. Click **Next**.

5. At the **Configure Claim Rule** stage:

   5.1. In the **Claim rule name** field, enter a name for the rule.

   5.2. In the **Attribute store** field, select **Active Directory**.

   5.3. In the **LDAP Attribute** column, specify what will be passed as the user identifier (External ID). You can specify:

   * **User-Principal-Name** — user name;
   * **E-Mail-Addresses** — email.

   5.4. In the **Outgoing Claim Type** column, select **Name ID**.

6. Click **Finish** → **OK**.

## 6. Configure user group mapping \{#configure-mapping}

Group mapping must be configured if you enabled automatic user creation when [creating a federation on the Selectel side in step 2](#create-federation-for-selectel). Use the [Configure group mapping](/access-control/groups/mapping.mdx#configure-group-mapping) subsection of the [User group mapping](/access-control/groups/mapping.mdx).

<Formbricks />