You’re using an older browser version. Update to the latest version of Google Chrome, Safari, Mozilla Firefox, or Microsoft Edge for the best site experience.

Steps to configure SAML 2.0 SSO with Microsoft Active Directory Federation Services


Note: ADFS 2.0 on Windows Server 2008 r2 or ADFS 3.0 on Windows Server 2012 / 2012 r2)

SAML 2.0 single sign-on (SSO) supports integration with Microsoft Active Directory Federation Services (ADFS) 3.0.


  • A fully installed and configured ADFS service.

  • A server running Microsoft Server 2008r2 or 2012/2012r2

  • An SSL certificate to sign your ADFS login page and the thumbprint of that certificate

In this example we are using ADFS 2.0 on Windows Server 2008 R2. On Windows Server 2012 the steps will be the same except for the installation, because you install AD FS role via the server manager, not via the installation package as on Windows 2008 server r2.

Step 1. AD FS Management

Login in to your AD FS server and launch the ADFS Management Console via the shortcut in Control Panel\Administrative Tools.

Step 2. Check AD FS settings

Right-click on Service and sel ect Edit Federation Service Properties...

Confirm that the General settings match your DNS entries and certificate names. Make a note with the Federation Service Identifier, since that is used in the iSpring Learn SAML 2.0 configuration settings.

Step 3. Token-Signing certificate

  1. Browse to the certificates.

  2. Right-click on the certificate and sel ect View Certificate.

  3. Go to the Details tab.

  4. Find the Thumbprint field and copy the contents of this field to the Windows clipboard.

Step 4. Learn Settings

  1. Log in into your iSpring Learn account and go to the SSO settings via this link: https://YourAccо

  2. Ins ert your Thumbprint into the Certificate Fingerprint field and remove all spaces between characters.

  3. Enter your data to the Metadata URL, Sign ON URL and Logout URL fields.


Step 5. ADFS Relying Party Configuration

Go to the ADFS Management console and select Relying Party Trusts, right-click on it and select Add Relying Party Trust…

Select Next On the Welcome Screen of the wizard, and on the Select Data Source step, select the last option: Enter data about the relying party manually.

On the next screen, enter a Display name that you will recognize in the future.

Next, select AD FS profile:

Leave the default values:

On the next screen, check the box labeled: Enable support for the SAML 2.0 WebSSO protocol. The service URL will be: https://YourAccо

Click Next. Add Relying party trust identifier:  https://YourAccо

Choose Permit all users to access this relying party.

On the next step, just click Next.

On the final screen, check the box Open the Edit Claim Rules dialog and use the Close button to exit.

Step 6. Creating Claims Rules

  1. Add the first rule

  2. Select Send LDAP Attributes as Claims

  3. On the next screen, specify your Claim Rule, for Example E-mail to Learn, using Active Directory as your attribute store, and do the following:

    • Fr om the LDAP Attribute column, select E-Mail Addresses

    • Fr om the Outgoing Claim Type, enter “email

    • Click on Finish or OK to save the new rule

  4. After that, add the second rule and select Transform an Incoming Claim as the template

    • Give your Claim Rule a title, for example, Transform Account Name

    • Select Windows account name as the Incoming Claim Type

    • Under Outgoing Claim Type, select Name ID

    • Under Outgoing Name ID Format, select Transient Identifier

    • Leave the default rule Pass through all claim values

  5. Finally, click on OK to create the claim rule, and then OK again to finish creating rules.

Step 7. Adjusting the Trust Settings

Some settings on your Relying Party Trust will need to be adjusted. To access these settings, select Properties from the Actions sidebar on the right while you have the Relying Party Trust selected.

Step 8. Logging

Go to your SSO login page: https://YourAccо and enter your credentials.

If you still have any questions, please ask them in our Community Forum.

Related Articles