Configuring Active Directory with AD FS and SAML for Brainloop Secure Dataroom Setup Guide

(1)

Configuring Active Directory with AD FS

and SAML for Brainloop Secure Dataroom

Setup Guide

(2)

Content

1 Introduction ... 3

2 Add Relying Party Trust ... 3

3 Create Claim Rules ... 9

4 Add SAML Logout ... 12

(3)

1 Introduction

This setup guide is intended for system administrators configuring Active Directory with AD FS (Active Directory Federation Services) and SAML for use with Brainloop Secure Dataroom.

For information on setting up SAML authentication in Brainloop Secure Dataroom, please refer to our SAML setup and user guide “Configuring SAML Authentication for Brainloop Secure Dataroom”.

2 Add Relying Party Trust

1. Start AD FS Management.

2. Select the Relying Party Trusts folder from AD FS Management. 3. Add a new Standard Relying Party Trust from the Actions sidebar.

This starts the configuration wizard for a new trust.

4. In the Welcome screen, click Start.

(4)

6. In the Specify Display Name screen, enter a Display name that you recognize in the future and any notes you want to make, then click Next.

(5)

7. In the Choose Profile screen, select the AD FS profile option and click Next.

(6)

9. In the Configure URL screen, enable the Enable support for the SAML 2.0 WebSSO protocol option. As the service URL, enter https://my.brainloop.net/newlogin/saml.aspx (or replace “my.brainloop.net” with your server domain) and click Next.

10. In the Configure Identifiers screen, in the Relying party trust identifier field, enter

(7)

11. In the Configure Multi-factor Authentication Now screen, select the I do not want to configure multi-factor authentication settings for this relying party trust at this time option and click Next.

12. In the Choose Issuance Authorization Rules screen, select the Permit all users to access this relying party option and click Next.

(8)

13. In the Ready to Add Trust screen, an overview of your settings is displayed. Click Next.

(9)

3 Create Claim Rules

1. Once you have completed all the steps described in the previous chapter, the Edit Claim Rules editor is displayed:

2. Click Add Rule.

(10)

4. In the Configure Claim Rule screen, enter a Claim rule name and select Active Directory as your Attribute store.

5. Next, make the following settings:

- In the LDAP Attribute column, select E-Mail Addresses. - In the Outgoing Claim Type column, select E-Mail Address. 6. Click Finish.

7. Now, create another new rule by clicking Add Rule, this time selecting Transform an Incoming Claim as the template.

(11)

8. In the Configure Claim Rule screen, enter a Claim rule name and make the following settings: - Incoming claim type: select E-Mail Address

- Outgoing claim type: select Name ID - Outgoing name ID format: select Email

- Leave the default rule Pass through all claim values enabled.

9. Click Finish.

(12)

4 Add SAML Logout

1. From the Actions sidebar or from the context menu on the created Relying Party Trust, select Properties.

(13)

3. Make the following settings:

- Endpoint type: select SAML Logout - Binding: select POST

- Trusted URL: type https://my.brainloop.com/newlogin/SingleSingOut.aspx

4. Click OK.

5. Confirm your changes by clicking OK in the properties dialog.

IMPORTANT: In order to be able to log in with SAML, e-mail addresses for users must be defined.

(14)

5 Appendix: Document revision history

Version Date of change Revision