SAML: ADFS Configuration

This document provides instructions for creating an application within ADFS for compatibility with BloodHound Enterprise.

For general instructions on adding a SAML provider to BloodHound Enterprise or for configuring users to utilize a SAML provider, see SAML in BloodHound Enterprise.

See SAML Order of Operations and Quick Reference before starting.

Create an Application

1. In the AD FS management console, right-click on Relaying Party Trust and click “Add Relaying Party Trust”.

2. Choose “Claims aware” and click “Start”.

3. Insert the metadata URL based on your chosen name and click “Next.”

4. Enter the preferred display name and click “Next.”

5. Choose the desired Access Control Policy. (Note that access and permissions are configured within BloodHound Enterprise).

6. Review the information presented and click “Next”.

7. Leave the “Configure claims issuance policy for this application” box checked and click “Close”.

Complete SAML Integration Configuration

1. On the “Edit Claim Issuance Policy” dialog box, click “Add Rule…”.

2. Choose “Send LDAP Attributes as Claims” and click “Next.

3. Fill out the following and click “Finish”.

   LDAP Attribute: E-Mail-Addresses Outgoing Claim Type : E-Mail Address

4. Click “Add Rule” to add another claim rule.

5. Choose “Transform and Incoming Claim” and click “Next”.

6. Fill out the following and click “Finish”.

   Incoming claim type: E-Mail Address Outgoing claim type: Name ID Outgoing name ID format: Email Choose “Pass through all claim values”

7. Click “Apply”.

8. Download the metadata file provided by your ADFS environment. By default, this is hosted at: https://YOURDOMAIN/federationmetadata/2007-06/federationmetadata.xml
9. Follow the instructions at SAML in BloodHound Enterprise to create the SAML provider in BloodHound Enterprise.