Integrate with Active Directory Federation Services

Below you can find a step by step tutorial on how to integrate Active Directory Federation Services IdP with MetaDefender Managed File Transfer using the OpenID Connect protocol.

1. Open the Server Manager Desktop App and navigate to Tools → AD FS Management

2. Inside the AD FS Management app navigate to Application Groups → Add Application Group
3. Enter a descriptive name for the application group and select the Server application accessing a web API template

4. To find the Login redirect URI
   1. Go to MetaDefender Managed File Transfer web console and navigate to Settings → Single Sign-On
   2. Turn on Enable Single Sign-On

5. Add the copied URI to the list of known redirect endpoints and save the Client Identifier for later use

6. We will require a client secret, so select the Generate a shared secret action and copy the generated GUID for later use

7. Add the client identifier (generated at step 5) to the list of known clients

8. Choose which users will be allowed to authenticate. For the purpose of this tutorial we will be allowing everyone

9. Last but not least we must configure the allowed scopes. It is mandatory to select:
   1. openid → for enabling the OpenID Connect protocol
   2. profile → to receive the user’s name related claims (upn, display_name, first_name, last_name)
   3. email → to receive the user’s email claim (necessary for administrator role asignment)
   4. allatclaims → to allow the profile and email related claims to be contained in the identity token, since AD FS does not allow loading profile related claims from the userinfo endpoint

10. After the above setup is complete, the newly created application group should be displayed in the application groups list

11. There is just one more step to complete on the AD FS server side, attribute to claim mapping. Double click the newly created application group and edit the Web API

12. Navigate to the Issuance Transform Rules tab and click Add Rule…
13. Select the Send LDAP Attributes as Claims template and click Next

14. Select Active Directory as an Attribute store and create the following mappings. MetaDefender Managed File Transfer recognizes the following claims:
    1. upn (required)
    2. email (required)
    3. name (optional)
    4. given_name (optional)
    5. family_name (optional)

15. Click Finish and Apply
16. On Managed File Transfer's side, input the Client ID (created at step 5) and Client Secret (created at step 6)

17. In case of misplacement, the Client ID and Client Secret can be fetched by accessing the application group’s affiliated server application

18. Add relevant Administrator Emails to select which users should be granted administrator rights and add the allatclaims scope to Integration Scopes

19. If everything is ready, click Update.

Testing the integration

To test the integration:

• Log out of MetaDefender Managed File Transfer
• You will notice that there is a new Sign In with SSO button on the login page

• Click Sign In with SSO. You should be redirected to Active Directory Federation Services to login. Once logged in, you will be redirected back to MetaDefender Managed File Transfer and automatically logged in.