There are many SAML-compliant identity providers (IdPs) available, each with its own unique setup process. This guide will give you a general overview of how to connect a SAML source to Edlink but if you have trouble with your specific provider, please reach out to Edlink support for assistance.
Step 1: Choose the NameID identifier
On the SAML source, select whether your Identity Provider will send email address or person external ID as the SAML NameID.
- Email address matches the NameID to the person's email on the primary roster source.
- Person external ID matches the NameID to
source.people.external_idon the primary roster source (case-sensitive).
Configure your IdP to send that same value as NameID. Edlink will not try the other field if the selected value is missing or does not match a roster person.
Step 2: Create an Application in Your Identity Provider
Create an application in your identity provider's dashboard. This process will vary depending on the provider you are using.
When doing this you will be asked for the Supplying Party's (SP) Assertion Consumer Service (ACS) URL and Metadata. You will find these values in the next step of the onboarding when connecting SAML.
Step 3: Enter your Metadata
The next step of the onboarding will ask you to enter your Identity Provider's (IdP) Metadata. This is usually provided as a URL or XML file by your identity provider. Both options are available in the onboarding.
Well Done!
You're finished! SSO through your IdP should now be functional.
ADFS Specific Config
There are a couple additional steps needed when using ADFS as your identity provider.
Disabling Assertion Encryption
ADFS will attempt to sign Assertions by default. Please disable this for the Edlink application in ADFS. You can do this two ways:
- In the ADFS Management Console:
- Navigate to the Relying Party Trusts section.
- Right-click on the Edlink application and select "Properties."
- Go to the "Encryption" tab
- Click Remove to remove the encryption certificate.
- Click OK to save the changes.
- Using PowerShell:
- Open PowerShell with administrative privileges.
- Run the following command to remove the encryption certificate for the Edlink application:
Set-AdfsRelyingPartyTrust -TargetName "the name you used goes here" -EncryptionCertificate $null
Additionally, ensure that the certificate is not fetched again by disabling monitoring:
Set-AdfsRelyingPartyTrust -TargetName "the name you used goes here" -MonitorEnabled $false
Configuring Claim Rules
You will need to create claim rules to send the appropriate attributes to Edlink. Send either email or the roster person external ID as NameID, matching the identifier selected on the Edlink SAML source.
You will need to create a claim transform rule for email. Here is an image of the config you need:
Azure AD Specific Config
When using Azure AD as your identity provider, you will need to download the SAML metadata from Azure and upload it to Edlink during the onboarding process. You are looking for the Federation Metadata XML link in the Azure portal.
This image shows where to find the metadata in the Azure portal:
