Adding Relying Party Trust in AD FS

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US
  1. In AD FS, navigate to Open AD FS management Console (Control Panel) > Administrative Tools > AD FS.
  2. Select Import data about the relying party published online or on a local network to provide a SAML metadata URL (e.g., https://jamfpro.example.com/saml/SSO) or Import data about the relying party from a file to upload a metadata XML downloaded from Jamf Pro.
  3. Click Next.

    AD FS may inform you that partial metadata content is not supported. This warning can be ignored.

  4. Continue with the wizard:
    1. For Ready to Add Trust, ensure the Endpoints tab contains multiple endpoint values.

      If the endpoint domain names are set to localhost, change them to a value visible from the AD FS server, such as your computer name or IP address.

    2. Make sure the Display name matches Entity ID in Jamf Pro.
  5. Select the Open the Edit Claim Rules dialog checkbox and finish the wizard.
  6. Select Add Rule, choose "Send LDAP Attributes as Claims" and click Next.
  7. Add a new claim rule with the following settings:
    • Name —Jamf Pro
    • Attribute Store —Active Directory
    • LDAP Attributes & User Mappings —Set the Token-Groups - Unqualified Names outgoing claim type to Group.

      • If the Jamf Pro User Mapping setting is set to Username, set SAM-Account-Name outgoing type to Name ID.

      • If the Jamf Pro User Mapping setting is set to Email, set a parameter that includes the user's email as an outgoing type (e.g., Principal-User-Name, E-Mail Address).

      Note:

      If LDAP directory services is configured in Jamf Pro, for Name ID use the same LDAP property as used during LDAP configuration. If using a custom user mapping attribute, refer to the AD FS documentation.