Skip to main content
Documentation & User Guides | FotoWare

FotoWeb Authentication with Active Directory Federation Services (ADFS)

  1. Last updated
  2. Save as PDF

This is the recommended way of connecting FotoWeb to an on-premise Active Directory and allowing users to sign in to FotoWeb with their Active Directory accounts.

 

Setting up and managing Active Directory and ADFS efficiently and securely can be a demanding task.  This approach is recommended for organizations that already have their own installation of Active Directory, and, ideally, ADFS,  and intend to keep using it.


Otherwise, you can use the following alternatives:

  • Rather than using ADFS + SAML authentication, consider using Microsoft Azure Active Directory B2C to synchronize your on-premise AD to Azure AD,  then use the Azure AD integration of FotoWeb. For documentation and pricing, see microsoft.com.

  • Rather than using your own Active Directory, consider using Microsoft Office 365 and the Azure AD integration of FotoWeb for authentication. This is a fully cloud-based authentication solution that requires only minimal setup and management. For documentation and pricing, see microsoft.com.

While both alternatives may incur additional costs for cloud services, they may be more cost efficient than managing your own services and servers.

Setting up ADFS

If ADFS has already been set up for your domain,you can skip to the next section. Otherwise, learn how to set up ADFS.

Connecting ADFS to FotoWeb

On the ADFS server:

  1. Open the ADFS Management console.
  2. Go to the Trust Relationships node → Relying Party Trusts → Add Relying Party Trust.
    • In Select Data Source, choose Enter data about the relying party manually.
    • Choose a display name, for example, FotoWare.
    • Select AD FS profile.
    • Do not add a token encryption certificate.
    • In Configure URL, select Enable support for the SAML 2.0 WebSSO protocol.
    • In Configure URL, set the service URL to https://yourtenant.fotoware.cloud/fotoweb/auth/saml20/consume/ (remember the final slash).
    • In Configure Identifiers, add the URL of the FotoWeb tenant as an identifier, for example, https://yourtenant.fotoware.cloud/fotoweb/ (remember the final slash).
    • Do not configure multi-factor authorization.
    • Select Permit all users access to this relying party.
  3. Finish the wizard.

Editing claim rules

LDAP Claims.PNG

  1. Select the Relying Party Trust created in the previous step.
  2. Right click → Edit Claim Rules
  3. Add a rule of type Send LDAP Attributes as Claims with the following mappings:
  • Attribute Store → Active Directory
  • E-Mail-Addresses → email
  • Surname → sn
  • Given-Name → givenName
  • SAM-Account-Name → username

Built-in claim types are shown in double-quotes, for example, "Surname".

Claim types shown in monospace, for example,givenName must be typed in manually.

Name ID rule.PNG

  1. Add a rule of type Transform an incoming Claim with the following attributes:
  • Incoming claim type: username
  • Outgoing claim type: Name ID
  • Outgoing name ID format: Unspecified
  1. Select Certificates and double-click the Token-signing certificate.
    • In Details, select Copy to File.
    • Select Base-64 encoded X.509 (.CER).
    • If prompted, do NOT export the private key.
    • Select a file name.
    • Open the file in a text editor.

In the site settings of the FotoWeb tenant, do the following:

  1. Go to Settings → Authentication Providers.
  • Select SAML 2.0.
  • In SAML 2.0 endpoint url, enter https://youradfsserver/adfs/ls
  • In X.509 Certificate, paste the contents of the .CER file exported from the ADFS configuration (previous step).
  • Add at least one group.
  1. Save the settings.

Mapping groups

Mapping groups from ADFS to FotoWeb is described in a separate topic.

Testing sign-in with ADFS

Depending on how ADFS is set up, the ADFS server may be accessible only from the internal network in which it resides, whereas FotoWeb may be accessible on the open internet (for example, when using FotoWare SaaS).

  1. Go to the home page of the FotoWeb tenant.
  2. In the login form, select Log in with SSO.
    • The sign-in page for the ADFS server opens. 
  3. Log in with a user's AD credentials
    • You are redirected back to FotoWeb and you are logged in.