ADFS / SAML 2.0 SSO | Communifire Documentation

On visiting your intranet, users will be re-directed to your organization log in page.

Logging in with Communifire credentials

You can allow users to log in using Communifire credentials. Set System Properties > EnableAutoLoginViaSaml to false. When this property is set to false, users will see the Communifire login page. Users can either log in with Communifire credentials or click Login via SAML to sign in using ADFS/SAML credentials.

Session expiration

By default, the session expires 30 days from the date of log in. You can control when the session expires using System Properties > FormsAuthPersistentCookieTimeOutInMinutes. By default this value is set to 43200, which is 30 days.

When the property MakePermanentCookieForThirdPartyLogin is set to true, a cookie is generated for the user that expires based on the value found in FormsAuthPersistentCookieTimeOutInMinutes. If MakePermanentCookieForThirdPartyLogin is set to false, the user will be logged out when the browser is closed.

Return to top

On the mobile app, users will be re-directed to your organization log in page after entering the site URL.

Logging in to app with Communifire credentials

You can allow users to log in to the app using Communifire credentials. Set System Properties > EnableAutoLoginViaSaml to false. When this property is set to false, users will see the Communifire login page after entering the site URL. Users can either log in with Communifire credentials or click Active Directory Login to sign in using ADFS/SAML credentials.

Return to top

A user is created in Communifire when the user logs in for the first time. You can add users to Communifire before they log in using the methods below.

Bulk import users

Pre-populate users before ADFS/SAML setup or launch with Bulk Import Users . The Communifire usernames you create must match the usernames in Active Directory.

Add users

Add users in Control Panel > People > Manage People > Add User . The Communifire username you create must match the username in Active Directory.

REST API

You can use our REST API to import users.

Adding administrator accounts

If Communifire administrator accounts are created before Active Directory is set up and the Communifire usernames match Active Directory usernames, the administrator accounts will sync with the corresponding Active Directory accounts. If not, you will need to re-configure permissions for the admin Active Directory accounts and remove the previous Communifire administrator accounts.

Return to top

Any data can be imported from Active Directory, as long as there are corresponding User Profile Fields in Communifire. Attribute mappings must be added to Control Panel > System > SAML Single Sign On > Mapping. Enter the outgoing claim type as the property name in Communifire. See the table below for common fields to import.

Note: The department field in Communifire is a Picklist Field . When departments are imported from ADFS, the departments are created as new options in the picklist field.

You can also use SQL or our REST API to import user data into Communifire.

Return to top

User data such as name, address, state, etc. is updated in Communifire every time a user logs in. User data is not updated if the user checks "Remember Me" on the log in page or if System Properties > EnableAutoLoginViaSaml is set to true.

Return to top

When a user is disabled in Active Directory, this information is not sent to Communifire. You can Delete User and delete their content or re-assign their content to another user or to the system anonymous user. You can also Ban User , which will prevent the user from logging in, but will retain their content.

Return to top

Note: Both the Service provider (your Communifire site) and Identity provider (ADFS) must run on HTTPS.

1. Login to the ADFS Server and search for Server Manager.
   
   
   
   
2. Launch the AD FS Management window.
   
   
3. On the left hand tree view, right click on Relying Party Trust and select Add Replying Party Trust...
   
   
   

    

4. On the Welcome page, choose Claims aware and click Start.
   
   Note: If you don't see Claims Aware section, click Start directly.
   
   

5. Choose Enter data about the relying party manually and click Next.
   
   

   

6. Enter Display Name of your Communifire application. You can choose any name and provide description of the application under Notes, and then click Next.
   
   

   

7. Select AD FS 2.0 profile (this option may also appear as AD FS profile).
   
   Note: You may or may not see this page.
   
   

   

8. To move to the next step you need public certificate of your Communifire application domain. If you have it handy then put it on your AD FS server, or you can also get it from your browser as shown below.
   
   Click on the lock icon from the search bar when Communifire site is open in your browser and select View certificates.
   
   Note: If you have a custom domain but need Axero to install your SSL certificate, submit it along with your saml.config file in your private case here.
   
   
   Select the Details tab and click on Copy to File... button to export the certificate to your desktop.
   
   
9. Browse the public certificate (.cer) of your Communifire application and then click Next.
   
   

   

10. Check Enable support for the SAML 2.0 WebSSO protocol.
11. In the Relying party SAML 2.0 SSO service URL textbox, enter the following URL: https://cftesting.com/SAML/AssertionConsumerService.aspx. (Replace cftesting.com with your Communifire domain).
    

    

12. Click Next.
13. In the Relying party trust identifier textbox, enter a unique identifier for your provider. We suggest using the pattern urn:company:site for your identifier. Save this identifier as you will use it to configure Communifire settings.
    

    

14. Click Add.
15. Click Next.
16. Select Permit all users to access this relying party.
    

    

17. Click Next.
    

    

18. Click Next.
    

    

19. Click Close.
20. In Trust Relationships > Relying Party Trusts, select the trust you created.
21. In the Actions pane, click Edit Claim Issuance Policy
    
    

    

22. Click Add Rule

    ...

23. In the Add Transform Claim Rule Wizard, select Send LDAP Attributes as Claims in the Claim rule template dropdown menu.
    

    

24. Click Next and complete the Add Rule process.
25. Click on the trust.
26. In the Actions pane, click Edit Claim Rules...
27. In Claim rule name, enter a name for your rule. In our example we have entered "Active Directory Attributes".
28. In the Attribute Store dropdown menu, select
    
    
29. Under Mapping of LDAP attributes to outgoing claim types, enter the attributes and types as below.
    
    Basic properties:
    
    

    LDAP Attribute	Outgoing Claim Type
    User-Principal-Name	Name ID
    Department	Department
    E-Mail-Addresses	Email
    Given-Name	GivenName
    Surname	Surname
    title	Title
    Telephone-Number	TelephoneNumber
    thumbnailphoto	ThumbnailPhoto

    Note: The department field in Communifire is a Picklist Field . When departments are imported from ADFS, the departments are created as new options in the picklist field.

    More properties:

    LDAP Attribute	Outgoing Claim Type
    Company	Company
    postalCode	PostalCode
    Street-Address	StreetAddress
    l	Location
    l	City
    State-Or-Province-Name	State
    co	Country
    wwwhomepage	Website

30. Click Finish.
31. Click Add Rule...
32. Select Send Claims Using a Custom Rule.
    
33. Click Next.
34. For Claim name, enter "Set manager domain to claims list"
35. Enter the following in Custom rule:
    

    c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]=> add(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/ManagerDN"), query = ";Manager;{0}", param = c.Value);

    
    
36. Click OK.
37. Click Add Rule...
38. Select Send Claims Using a Custom Rule.
39. Click Next.
40. For Claim name, enter "Get manager SAM-Account-Name"
41. Enter the following in Custom rule:
    

    c1:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
    && c2:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/ManagerDN"]
    => issue(store = "Active Directory", types = ("Manager"), query = "(distinguishedName={1});samaccountname;{0}", param = c1.Value, param = c2.Value);
    

    
42. Click OK.
43. Click Apply, then click OK.
    Your claim rules should now look like the image below.

    

44. In the Actions pane of the trust, click Properties.
45. Select the Signature tab.
    

    

46. Click Add.
47. Select the public SSL certificate of your Communifire site.
48. Click the Advanced tab.
49. In the Signature hash algorithm dropdown menu, select SHA-256.
    

    

50. Select the Endpoints tab.
    

    

51. Click Add SAML
    
    
    
52. In the Endpoint type dropdown menu, select SAML Logout.
53. In the Binding dropdown menu, select Redirect.
54. In the URL textbox, enter the following URL: https://cftesting.com/SAML/SLOService.aspx. (Replace cftesting.com with your Communifire domain).
    
    

    

55. Click OK then click Apply.
    
    In the Endpoints tab, you will now see two endpoints, one for login (Assertion Consumer) and one for logout.
    
    

    

In ADFS management console:

1. Click Edit.
   

   

2. Check Forms Authentication in both the Extranet and Intranet sections. Leave the other check boxes unchecked.
   
   

   

3. Click OK.

In Power Shell:

Run the following command:

Set-ADFSRelyingPartyTrust -TargetName <RelyingPartyTrustName> -SamlResponseSignature MessageAndAssertion

Replace <RelyingPartyTrustName> with your Relying Party Trust name. You can find your Relying Party Trust name in the Relying Party Trusts section of the ADFS management console.

Identity Provider Configuration

If you have installed ADFS properly, the following URL should give you a valid response in XML format: https://win-chqnt9vspbj.adfs.test/FederationMetadata/2007-06/FederationMetadata.xml
(Replace https://win-chqnt9vspbj.adfs.test with your Identify Provider.)

To get the URL of your identity provider, go to ADFS console and click Edit Federation Service Properties.

Now restart the server. 

Next you need to collect the following three values from ADFS FederationMetadata xml https://<adfsdomain>/FederationMetadata/2007-06/FederationMetadata.xml

• Partner IDP
• SingleSignOnServiceUrl
• SingleLogoutServiceUrl

In the image below, the highlighted portion is the Partner IDP.

Following is the value for "SingleSignOnServiceUrl" and "SingleLogoutServiceUrl" from that xml:

Those three values need to be entered in Communifire in Control Panel > System > Single Sign On > SAML. (See the Configure Communifire section.)

Setup Confirmation

If your setup was done correctly, you will see the page below at https://WIN-CHQNT9VSPBJ.adfs.test/adfs/ls/. (Replace https://WIN-CHQNT9VSPBJ.adfs.test with your Identify Provider.)

If you don't see the page above, check your Windows Event Logs.

If you want to enable the SAML trace, add the following code in web.config:

 <system.diagnostics>
    <trace autoflush="true">
      <listeners>
        <add name="TextWriter"/>
      </listeners>
    </trace>
    <sources>
      <source name="ComponentSpace.SAML2" switchValue="Verbose">
        <listeners>
          <add name="TextWriter"/>
        </listeners>
      </source>
    </sources>
    <sharedListeners>
      <!-- Ensure IIS has create/write file permissions for the log folder. -->
      <add name="TextWriter" type="System.Diagnostics.TextWriterTraceListener" initializeData="d:\logs\adfs-log.log"/>
    </sharedListeners>
  </system.diagnostics>

The above trace will help you to diagnose an error if it originates from the ADFS setup. initializeData is the path where logs will be written. Make sure that the path you specify has write access to your web application.

Check that the server where ADFS is installed has the time set correctly. Incorrect server time can cause ADFS to malfunction.

Return to top

1. Go to Control Panel > System > Single Sign On.
2. Select SAML.
3. Click Save.
4. Enter the following information with the information from the Configure ADFS section:
   
   • Partner Identity Provider URL: Enter the Partner IDP.
   • Single Sign On Service URL: Enter the SingleSignOnServiceUrl.
   • Relying Party Trust Identifier: Enter your intranet URL.
   • Single Logout Service URL: Enter the SingleLogoutServiceUrl.
   • Partner Identity Certificate (CER): Upload the PFX certificate file.
   • Certificate Password: Enter the PFX certificate password.
5. Click Update.
6. Click System > Advanced System Utilities.
7. Click Restart Site.

SAML SSO and auto login are now enabled.

How to disable SSO auto login

To disable SSO auto login, go to Control Panel > System > System Properties and set EnableAutoLoginViaSaml to false.

How to configure attribute mappings

In Control Panel > System > Single Sign On, click on the Data Mapping tab. Then select SAML in the Type menu. If you added more than the basic set of properties, you can add those here.

Advanced Configuration

When a user logs in using SAML, Communifire synchronizes user data with the Single Sign-On (SSO) system. This process is automatic by default. You have the flexibility to customize this integration by adjusting system properties:

• SAMLAutoUserCreation

  This property determines if SAML should create a new user automatically when a matching one isn't found during login. If the property is set to true, the system will automatically create a new user. Setting the property to false ensures that user accounts are not automatically created during SAML logins, providing a controlled approach to user management.

• SAMLUserEmailMatch

  This option determines whether Communifire will verify if the user logging in via SAML has a matching email address for the user with the same username. By setting the property to true, Communifire will enforce the verification step. This added layer of security helps in scenarios where precise user validation is crucial. When this property is set to false, this verification step will be skipped.

• SAMLAutoUserUpdate  

  This property controls whether Communifire will automatically update user data from the SSO system. By default, this property is set to true, allowing for automatic updates, which ensures the user information is up-to-date. To prevent automatic updates, set the property to false.

Return to top

You can sync user roles from ADFS to Communifire with the help of rules defined in ADFS.

1. Login to the ADFS Server and search for Server Manager.
   
2. Launch the AD FS Management window.
   
3. On the left hand pane, click on Relying Party Trust
4. Select the trust in the main pane
5. In the Actions pane, click Edit Claim Issuance Policy 
   
6. Click Add Rule...
   
7. Select Send Group Membership as a Claim as the rule template
   You can also select Send Claims Using a Custom Rule. See Configure a custom rule.
   
8. Click Next
9. Configure the rule:
   • Claim rule name: Enter a name for the rule (any)
   • User's group: Select the role that you would like to sync with Communifire
   • Outing claim type: Select Role
   • Outgoing claim value: Enter the value to send to Communifire
     
10. Click Finish
    You'll see the new rule in Issuance Transform Rules

Configure a custom rule

Another way to sync user roles is with Send Claims Using a Custom Rule as the rule template. This approach gives you the option to set a condition, and when it is true, it will issue a claim and return to the Relying party (Communifire).

Claim rule language is used to define the rule. See this guide for information about claim rule language.

Example claim rule:

Assign Users to Spaces According to their Roles

Once roles are synced with Communifire, you can use User Space Assignment Rules to add users to specific spaces based to their roles.

1. Select the space to assign the users to.
2. Select the role the users will have in that space.
3. Enter an email domain.
   • Do not include the www or the at-symbol (@).
   • Enter * for all email domains.
4. Select a role to limit the rule to a group of users.
   • Select All if you do not want to limit by role.
5. Click Save.

Return to top

"The SAML encryption isn't encrypted."

Please check that the encryption certificate is configured in the Relying Party Trust.

"No AssertionConsumerService is configured on the relying party trust 'urn:abc:xyz' that is a prefix match of the AssertionConsumerService URL 'http://yourwesbite/SAML/AssertionConsumerService.aspx' specified by the request."

Check urn and AssertionConsumerService in both ADFS management and Communifire.

On login: "Error creating your Active Directory account. Please contact your Site Administrator." In the exception log: "No attributes returned from Active directory. Please go to 'Active Directory Users and Computers' on ADFS Server, select the 'user@xyz.com' user, go to 'Account' tab and check the 'User logon name' information is present there."

The attributes could be empty in Active Directory for that user:

Error on ADFS login page:
"Exception details:
Microsoft.IdentityServer.Web.InvalidScopeException: MSIS7007: The requested relying party trust 'https://yourcommunity/' is unspecified or unsupported. If a relying party trust was specified, it is possible that you do not have permission to access the trust relying party. Contact your administrator for details."

Solution: The name present in urn field in ADFS relying partner trust and in Communifire should match.

ADFS setting screenshot:


In Communifire, check Control Panel > System > Single Sign On > SAML > Relying Party Trust Identifier.

Users are able to login via ADFS/SAML using Chrome and Firefox, but not Internet Explorer.

Make sure that the SPN is configured properly for your ADFS service account. A service principal name (SPN) is a name that uniquely identifies an instance of a service. There should be an SPN registered for your ADFS service account. To verify this, refer to the following instructions:

1. On the domain controller server, click Start.
2. Click Run.
3. Enter adsiedit.msc to launch the ADSIEdit MMC console.
4. If necessary, connect to the site server's domain.
5. In the console pane, expand the site server's domain.
6. Expand DC=<server distinguished name>.
7. Expand CN=Users.
8. Right-click CN=<Service Account User>.
   The service account user is usually the administrator account.
9. On the context menu, click Properties.
10. In the CN=<Service Account User> Properties dialog box, review the servicePrincipalName value to ensure that a valid SPN has been created. If not, then add the value in this format: HTTP/FQDNADFS & Communifire Guide.

"Microsoft.IdentityServer.RequestFailedException: MSIS7065: There are no registered protocol handlers on path /adfs/ls/ to process the incoming request.
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)"

Make sure the following two properties have https protocol which you added in ADFS configuration.

SingleSignOnServiceUrl="https://qaadfs.communifire.com/adfs/ls/"
SingleLogoutServiceUrl="https://qaadfs.communifire.com/adfs/ls/"

"SAML authentication error: No attributes returned from Active directory."

Go to 'Active Directory Users and Computers' on ADFS Server, select the 'Administrator@adqa.communifire.com' user, go to 'Account' tab, and check the 'User logon name' information is present there.

Go AD controller and edit the user's logon name and enter a valid value.

"There is no SAML configuration."

Enable SAML trace log via adding diagnostic element (as described in the Configure ADFS section) then check the error in the logs. The certificate path may be wrong, or there may be duplicate certificate locations in both Partner and Service provider.

"There is no such relying partner."

Make sure the Relying Partner Trust Identifier in Communifire and in ADFS management console match.

The identity provider doesn't allow the response to be signed.

Set WantSAMLResponseSigned to false in SAML config.

Issue:

1. The X.509 certificate could not be loaded from the file .....\Assets\Uploaded-CMS-Files\saml\.....pfx.
2. Keyset does not exist 
3. There is no SAML configuration

Solution: 

We need to check multiple things here:

1. In IIS, Anonymous Authentication > Anonymous user identity should be set to Application pool identity.

2. Your site's application pool should have Read permission for the private keys of your site's certificate:

• Select Run from the Start menu, then enter certlm.msc. 
• Expand the Personal folder and click Certificates.
• Right-click the site certificate > All Tasks > Manage Private Keys...

• In the Security tab, click Add.. and add your site's application pool identity.
• Select your site application pool.
• For the Read permission, check Allow.

• Click OK.

3. The certificates should be exported from the Certificate Manager tool (both PFX and CER):

• Right-click the certificate for your site > All Tasks > Export...
• Follow the Certificate Export wizard prompts to export the certificates:
  • For the CER certificate, select No, do not export the private key.
  • For the PFX certificate, select Yes, export the private key.

• The CER, and PFX files should be added in \Assets\Uploaded-CMS-Files\saml. Settings should be updated in Control Panel > System > Single Sign On > SAML.

4. In IIS, Process Model > Identity should be ApplicationPoolIdentity.

5. In Communifire > Control Panel > System > System Properties, the following System Properties should be set as follows:

• EnableSAMLIntegration: true
• SingleSignOnMode: 3
• PartnerIdP: A URL like http://qaadfs.communifire.com/adfs/services/trust
• SAMLCertificateFileName: raghav.communifire.com.pfx
• SAMLCertificatePassword: pass565
• SAMLTenantID: Leave this as empty.

There is no need to set the identity to localsystem.

6. Restart the app pool after making changes to system properties.

ADFS Logs: System.UriFormatException: Invalid URI: The format of the URI could not be determined.

Make sure the domain name is entered in "Relying Party Identifiers" instead of urn:domain.

No AssertionConsumerService is configured on the relying party trust 'microsoft:identityserver:xxxxxxxxxxxxxxxxxxxx' that is a prefix match of the AssertionConsumerService URL

Make sure that the relying party trust identifier has the "SAML Assertion Consumer" Endpoint as https://{domain}/SAML/AssertionConsumerService.aspx

Example: https://myintranet.communifire.com/SAML/AssertionConsumerService.aspx

Return to top