Enabling single sign-on via ADFS

Set up single sign-on to Robin with ADFS (Active Directory) and SAML 2.0. Robin supports ADFS single sign-on with SAML 2.0, which is available on ADFS version 2.0 and above. For general questions about SAML support, see Enabling single sign-on via SAML 2.0. SAML authentication is available for organizations with Advanced Authentication and Security.

Using Microsoft Entra ID (formerly Azure Active Directory) and not ADFS? Follow Enabling single sign-on via Microsoft Entra ID instead.

This guide uses the most likely ADFS defaults. If some fields in this guide differ from your default ADFS claims, use transform rules in ADFS to send the right format back to Robin. You do not need to change anything on the service provider side.

This article covers:

• Add your ADFS identity provider to Robin
• Configure Robin in ADFS, with either:
  • Option 1: PowerShell
  • Option 2: Manual configuration
• Copy the certificate into Robin
• Troubleshoot ADFS sign-in errors

Add your ADFS identity provider to Robin

1. As an admin, go to Manage > Security. You can also go to Manage > Integrations and select Manage Sign-In Options.
2. In the SAML 2.0 card, select Add. The SAML configuration form opens.
3. Set Provider to Custom (Default).
4. For a default ADFS install, set these configuration options:
   • SAML SSO URL: https://yourdomain.com/adfs/ls
   • Identity Provider Issuer: https://yourdomain.com/adfs/services/trust
5. Expand Advanced Options and change 2 fields:
   • Uncheck Encrypt Assertion.
   • Under Auth Context, check Windows and leave Password Protected Transport checked. ADFS must sign the user in with one of the checked methods. Windows covers users signed in to your network. Password Protected Transport covers users who enter a password on the ADFS sign-in page.

The result: Provider is Custom (Default), the SAML SSO URL ends in /adfs/ls, the Identity Provider Issuer ends in /adfs/services/trust, Windows and Password Protected Transport are checked, and Encrypt Assertion is unchecked. You get the certificate from ADFS later in this guide.

Complete the rest of the setup with PowerShell or by hand in your ADFS management console.

Option 1: PowerShell

1. Run this command to add Robin as a relying party trust:

   Add-ADFSRelyingPartyTrust -Name "Robin Powered" -Identifier "https://robinpowered.com"

2. Run this command to import the claim rules and SAML endpoints from the downloaded file. Replace FULL PATH TO DOWNLOADED TRUST CLAIMS XML with the path to the file.

   Import-Clixml "FULL PATH TO DOWNLOADED TRUST CLAIMS XML" |
   foreach-object {
     $samlEndpoints = foreach ($endpoint in $_.SamlEndpoints){
       New-ADFSSamlEndpoint -Protocol $endpoint.Protocol -Uri $endpoint.Location -Binding $endpoint.Binding -IsDefault $endpoint.IsDefault -Index $endpoint.Index -ResponseUri $endpoint.ResponseLocation};
     Set-ADFSRelyingPartyTrust -TargetName "Robin Powered" -IssuanceTransformRules $_.IssuanceTransformRules -SamlEndpoint $samlEndpoints -SignatureAlgorithm $_.SignatureAlgorithm}

Next, copy the certificate into Robin.

Option 2: Manual configuration

In the AD FS management console, first add a Relying Party Trust for Robin. Then update the claims to include the user attributes that SAML authentication needs.

Add Robin as a Relying Party Trust

1. In the Actions panel of the AD FS management console, select Add Relying Party Trust to open the setup wizard.
2. Select Enter data about the relying party manually.
3. Add a display name you recognize, such as Robin or Robin Powered, then select Next.
4. Select AD FS Profile, then skip the next step. This setup does not need token encryption.
5. Select Enable support for the SAML 2.0 WebSSO protocol and enter https://dashboard.robinpowered.com/sso/saml/custom as the relying party URL.
6. Enter https://robinpowered.com as the Entity ID.
7. Select Permit all users to access this relying party.
8. Confirm the settings are correct, then save and close the wizard. The trust for Robin exists in AD. Update the claims before you connect with SAML.

Add claims

Add three claim rules to the Robin trust. Together they send each user's first name, last name and email to Robin, with the email as the Name ID.

1. Right-click the trust you created in the last section, and select Properties.
2. Under the Advanced tab, confirm the signature algorithm is SHA-256. Close the window.
3. Right-click the trust for Robin again, select Edit Claims, and open the Issuance Transform Rules tab.

Rule 1: Send user attributes

1. Select Add Rule > Send LDAP Attributes as Claims.
2. Enter a Claim rule name you recognize (for example, Robin SAML Attributes) and set Attribute store to Active Directory.
3. Map the LDAP attributes to these Outgoing Claim Types. The outgoing claim types for Robin are case-sensitive. Your attributes can differ. For example, your email addresses might be stored in a different attribute.

   LDAP attribute	Outgoing claim type
   Given-Name	FirstName
   Surname	LastName
   E-Mail-Addresses (or whichever field you use for email)	Email

4. Select OK.

Rule 2: Send the email as the Name ID

1. Select Add Rule > Transform an Incoming Claim.
2. Give this rule a name such as Robin Name ID Transform, then set these fields:

   Field	Value
   Incoming claim type	E-Mail Address
   Outgoing claim type	Name ID
   Outgoing Name ID format	Email

3. Select Pass through all claim values, then select OK.

Rule 3: Send the email from Active Directory

1. Select Add Rule > Send Claims Using a Custom Rule.
2. Enter a Claim rule name you recognize (for example, Robin Email Transform). Paste this text as a custom rule:

   c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
      Issuer == "AD AUTHORITY"]
    => issue(store = "Active Directory",
         types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"),
         query = ";mail;{0}",
         param = c.Value);

3. Select OK.

If this rule causes an InvalidNameIDPolicy error, use this transform instead:

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
   Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"]
     == "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"]
 => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
      Issuer = c.Issuer,
      OriginalIssuer = c.OriginalIssuer,
      Value = c.Value,
      ValueType = c.ValueType);

Check your rules

To check a rule, select it and select View Rule Language. Rule 1 looks something like this:

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",
   Issuer == "AD AUTHORITY"]
 => issue(store = "Active Directory",
      types = ("FirstName", "LastName", "Email"),
      query = ";givenName,sn,mail;{0}",
      param = c.Value);

Rule 2 looks like this:

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
 => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
      Issuer = c.Issuer,
      OriginalIssuer = c.OriginalIssuer,
      Value = c.Value,
      ValueType = c.ValueType,
      Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"]
        = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress");

If you cannot sign in after setup, see InvalidNameIDPolicy error.

Copy the certificate into Robin

Export the token-signing certificate from ADFS and add it to the SAML configuration in Robin.

1. In the AD FS management console, go to Service > Certificates. Right-click the certificate under Token-signing and select View Certificate.
2. Under the Details tab, select Copy to File to begin the export wizard.
3. Select Base-64 encoded X.509 (.CER), then choose where to save your certificate. Keep the defaults in the rest of the wizard: select Next or OK until it finishes.
4. Copy the contents of the certificate file you created, and paste it into the SAML configuration in Robin.
5. Save your configuration. SAML is enabled for your account.

Troubleshoot ADFS sign-in errors

If sign-in still fails after you complete this guide, check the ADFS logs. They show the exact error ADFS sent to Robin.

1. On the ADFS server, open Event Viewer.
2. Go to Applications and Services Logs > AD FS > Admin.
3. Find the error from your sign-in attempt.

For the full steps, see Check ADFS logs for SAML sign-in errors.

InvalidNameIDPolicy error

Robin requires a NameID. An InvalidNameIDPolicy error, or Actual NameID properties: null in the log, means ADFS did not find the user's email with the mapping in Add claims.

To fix it, edit the Transform an Incoming Claim rule and set these fields:

References

For more about SAML 2.0 identity providers, see MSDN: Use a SAML 2.0 identity provider to implement single sign-on.