ADFS- SSO setup with QuestionPro

Active Directory Federation Service (ADFS) is a Microsoft software component that provides Single Sign-On (SSO) authorization to users of Windows Server Operating Systems. ADFS enables users to access applications on Windows Server Operating Systems across organizational boundaries using a single set of login credentials.

ADFS enables users from one organization to access applications from partner organizations by using their standard Active Directory credentials (AD). ADFS also allows users to access AD-integrated applications while working remotely via a web interface, using their standard organizational AD credentials.

To connect ADFS and QuestionPro using SAML 2.0, follow the steps below:

• Install ADFS
• Go to: Start » All Programs » Administrative Tools, click on ADFS Management
• In the ADFS Management window, right click on Relying Party Trusts then click on Add Relying Party Trust

• In the setup wizard, select Claims aware and click on the Start button

• On the second step, select the Enter data about the replying party manually option and click on the Next button.

• On the third step, enter the name of the relying party trust and click on the Next button.

• On the fourth step, Upload the QuestionPro SP certificate and click on the Next button. Check out how to get the QuestionPro SP certificate here.

• On the fifth step, select Enable support for the SAML 2.0 SSO service URL, enter the ACS URL from your QuestionPro account, and click on the Next button. Check out how to get the ACS URL from your QuestionPro account here.

• On the sixth step, enter the Relying party trust identifier and click on the Add button on the right. Indentifier URL: https://www.questionpro.com/saml2

• You'll see the identifier added in the Relying party trust identifier section. Then click on the Next button.

• On the seventh step, review the permission of this app for your organization and click on the Next button.

• On the eighth step, review all the details added for the relying party trust and click on the Next button.

• Finally on the ninth step, click on the Close button.

• Now a new window will open-up to add the Claim Issuance Policy. In this new window, click on the Add Rule button to add a new claim policy rule for QuestionPro

• In the pop-up, under Claim rule template select Send LDAP Attributes as Claims and click on the Next button.

• Enter the claim rule name as emailAddress, select E-Mail-Address as the LDAP Attribute, and enter emailAddress as the Outgoing Claim Type. Click on the Finish button.

• You'll see the new claim rule added under claim policy for QuestionPro. Click the Apply button and then the OK button to finish the setup.

• All the steps on ADFS are complete, now go to your QuestionPro account » User Profile » Global Settings » SSO Authentication and upload the following information:
• Issuer/Entity ID: The issuer or entity ID will be in this format https://ADFS_SERVER/adfs/services/trust replacing ADFS_SERVER with your ADFS domain
• Signing Certificate: Check out how to extract the signing certificate from ADFS here.

• Now, to test out the SSO connection go to https://ADFS_SERVER/adfs/ls/IDpInitiatedSignOn.aspx replacing ADFS_SERVER with your ADFS server name. Select the Sign in to one of the following sites: option, choose the QuestionPro app and click the Sign in button. It will prompt you to enter the AD credentials and after successful authentication, you'll be redirected to your QuestionPro account.

Note: SP initiated SSO is not supported with ADFS and QuestionPro SSO connection.

Follow the steps below to get the SP certificate and ACS URL from your QuestionPro account:

• To get the SP certificate and ACS URL, login to your QuestionPro account>> click on the user profile icon>> click on the Global Settings .
• Under Global Settings, click on the SSO Authentication in the left navigation menu. Select SAML (Signed) option from the SSO Authentication dropdown menu.
• Here, you'll find the ACS URL and the option to download the SP certificate.

Note: These settings are visible to the primary user of your organization by default and the access can be provided to other users by using User roles and permissions.

Follow the steps below to extract the signing certificate from ADFS:

• Go to: ADFS Management » Service » Certificates. Double click on Token-signing certificate or right-click on Token-signing certificate and then click on View Certificate.

• In the pop-up window, go to the Details tab and click on the Copt to File button to export the certificate.

• The Certificate Export Wizard will open up click on the Next button to start the process.

• On the second step, choose Base-64 encoded X.509 (.CER) option and click on the Next button.

• On the third step, select the path where to export the certificate, enter the name for the file and click on the Next button.

• On the final step, click on the Finish button

Yes, It is possible to map new users to a specific Business Unit/ Team. You can pass a claim named "teamName" in your SAML assertion containing the Business Unit Name / Team Name from your QuestionPro account which will add new users under that specific Business Unit/ Team. In the following example shown in the screenshot we have used the "Department" field of the user's profile to store the Team Name for the user which will be passed in the SAML assertion: