Configuring SSO with AD FS

13min
Before configuring SSO, make sure that in config.env the APP_URL parameter matches the current Passwork domain, example — APP_URL=https://passwork.example.com
The following server names are used for the example:
Provider (IDP) — ad-fs.passwork.local
Passwork Server (SP) — passwork.example.com
Adding the trust relationship of the verifying party
Open — Server Manager → Tools → AD FS Management → Relaying Party Trusts → Actions:
﻿
Perform the steps in — Welcome to the Add Relaying Party Trust Wizard:
Claim aware;
Enter data about the relaying party manually;
Fill in the Display name (example: passwork-sp);
Skip the step — Configure Certificate, click Next;
In the Configure URL step:
Enable support for the SAML 2.0 WebSSO protocol;
Copy from Passwork to — Settings and Users → SSO Settings → Reply URL;
Put in Relaying party SAML 2.0 SSO service URL — https://passwork.example.com/api/v1/sso/acs
In the Configure Identifiers step:
Copy from Passwork to — Settings and Users → SSO Settings → Identifier (Entity ID);
Put in Relaying party trust Identifier — https://passwork.example.com/api/v1/sso/metadata
Skip the step — Choose Access Control Policy, click Next;
Skip the setp — Ready to Add Trust, click Next;
PowerShell
Get-ADFSRelyingPartyTrust -Name "passwork-sp" # Command for output

AllowedAuthenticationClassReferences : {}
EncryptionCertificateRevocationCheck : CheckChainExcludeRoot
PublishedThroughProxy                : False
SigningCertificateRevocationCheck    : CheckChainExcludeRoot
WSFedEndpoint                        :
AdditionalWSFedEndpoint              : {}
ClaimsProviderName                   : {}
ClaimsAccepted                       : {}
EncryptClaims                        : True
Enabled                              : True
EncryptionCertificate                :
Identifier                           : {https://passwork.example.com/api/v1/sso/metadata}
NotBeforeSkew                        : 0
EnableJWT                            : False
AlwaysRequireAuthentication          : False
Notes                                :
OrganizationInfo                     :
ObjectIdentifier                     : 03363cb7-5eef-ef11-b8b3-000c2993a976
ProxyEndpointMappings                : {}
ProxyTrustedEndpoints                : {}
ProtocolProfile                      : WsFed-SAML
RequestSigningCertificate            : {}
EncryptedNameIdRequired              : False
SignedSamlRequestsRequired           : False
SamlEndpoints                        : {Microsoft.IdentityServer.Management.Resources.SamlEndpoint}
SamlResponseSignature                : AssertionOnly
SignatureAlgorithm                   : http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
TokenLifetime                        : 0
AllowedClientTypes                   : Public, Confidential
IssueOAuthRefreshTokensTo            : AllDevices
RefreshTokenProtectionEnabled        : True
RequestMFAFromClaimsProviders        : False
ScopeGroupId                         :
ScopeGroupIdentifier                 :
DeviceAuthenticationMethod           :
Name                                 : passwork-sp
AutoUpdateEnabled                    : False
MonitoringEnabled                    : False
MetadataUrl                          :
ConflictWithPublishedPolicy          : False
IssuanceAuthorizationRules           :
IssuanceTransformRules               :
DelegationAuthorizationRules         :
LastPublishedPolicyCheckSuccessful   :
LastUpdateTime                       : 01.01.1900 5:00:00
LastMonitoredTime                    : 01.01.1900 5:00:00
ImpersonationAuthorizationRules      :
AdditionalAuthenticationRules        :
AccessControlPolicyName              : Permit everyone
AccessControlPolicyParameters        :
ResultantPolicy                      : RequireFreshAuthentication:False
                                       IssuanceAuthorizationRules:
                                       {
                                         Permit everyone
                                       }
                                       
Get-ADFSRelyingPartyTrust -Name "passwork-sp" | Select-Object -ExpandProperty SamlEndpoints # Command for output

Binding          : POST
BindingUri       : urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
Index            : 0
IsDefault        : False
Location         : https://passwork.example.com/api/v1/sso/acs
Protocol         : SAMLAssertionConsumer
ResponseLocation :              
Get-ADFSRelyingPartyTrust -Name "passwork-sp" # Command for output

AllowedAuthenticationClassReferences : {}
EncryptionCertificateRevocationCheck : CheckChainExcludeRoot
PublishedThroughProxy                : False
SigningCertificateRevocationCheck    : CheckChainExcludeRoot
WSFedEndpoint                        :
AdditionalWSFedEndpoint              : {}
ClaimsProviderName                   : {}
ClaimsAccepted                       : {}
EncryptClaims                        : True
Enabled                              : True
EncryptionCertificate                :
Identifier                           : {https://passwork.example.com/api/v1/sso/metadata}
NotBeforeSkew                        : 0
EnableJWT                            : False
AlwaysRequireAuthentication          : False
Notes                                :
OrganizationInfo                     :
ObjectIdentifier                     : 03363cb7-5eef-ef11-b8b3-000c2993a976
ProxyEndpointMappings                : {}
ProxyTrustedEndpoints                : {}
ProtocolProfile                      : WsFed-SAML
RequestSigningCertificate            : {}
EncryptedNameIdRequired              : False
SignedSamlRequestsRequired           : False
SamlEndpoints                        : {Microsoft.IdentityServer.Management.Resources.SamlEndpoint}
SamlResponseSignature                : AssertionOnly
SignatureAlgorithm                   : http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
TokenLifetime                        : 0
AllowedClientTypes                   : Public, Confidential
IssueOAuthRefreshTokensTo            : AllDevices
RefreshTokenProtectionEnabled        : True
RequestMFAFromClaimsProviders        : False
ScopeGroupId                         :
ScopeGroupIdentifier                 :
DeviceAuthenticationMethod           :
Name                                 : passwork-sp
AutoUpdateEnabled                    : False
MonitoringEnabled                    : False
MetadataUrl                          :
ConflictWithPublishedPolicy          : False
IssuanceAuthorizationRules           :
IssuanceTransformRules               :
DelegationAuthorizationRules         :
LastPublishedPolicyCheckSuccessful   :
LastUpdateTime                       : 01.01.1900 5:00:00
LastMonitoredTime                    : 01.01.1900 5:00:00
ImpersonationAuthorizationRules      :
AdditionalAuthenticationRules        :
AccessControlPolicyName              : Permit everyone
AccessControlPolicyParameters        :
ResultantPolicy                      : RequireFreshAuthentication:False
                                       IssuanceAuthorizationRules:
                                       {
                                         Permit everyone
                                       }
                                       
Get-ADFSRelyingPartyTrust -Name "passwork-sp" | Select-Object -ExpandProperty SamlEndpoints # Command for output

Binding          : POST
BindingUri       : urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
Index            : 0
IsDefault        : False
Location         : https://passwork.example.com/api/v1/sso/acs
Protocol         : SAMLAssertionConsumer
ResponseLocation :              
﻿
Open the Properties of the created Relaying Party Tusts:
﻿
In Properties, go to Endpoints and perform the following actions:
Add SAML;
Endpoint type — SAML Logout;
Binding — Redirect;
Copy from Passwork to — Settings and Users → SSO Settings → Logout URL;
Put in Trusted URL — https://passwork.example.com/api/v1/sso/sls
Apply the changes and close Properties.
Configuring rules for processing requests from SP (Passwork) in IDP (AD FS)
Depending on the kind of user login you want in Passwork, you can customize the processing rules so that the user format can be as follows:
username
[email protected]
Please select the desired user login format in Passwork and customize.
In the Relaying Party Trusts, stand on the created trust (passwork-sp) and open — Edit Claim Issuance Policy:
﻿
Perform the following steps:
Add Rule;
Send LDAP Attributes as Claims;
Claim rule name — AttributeStatement;
Attribute store — Active Directory;
LDAP Attribute — User-Principal-Name;
Outgoing Claim Type — UPN.
﻿
Perform the following steps:
Add Rule;
Transform an Incoming Claim;
Claim rule name — Name ID Format;
Incoming claim type — UPN;
Outgoing claim type — Name ID;
Outgoing name ID format — Transient Identifier.
﻿
Perform the following steps:
Add Rule;
Send LDAP Attributes as Claims;
Claim rule name — AttributeStatement;
Attribute store — Active Directory;
LDAP Attribute — SAM-Account-Name;
Outgoing Claim Type — E-Mail Address.
﻿
Perform the following steps:
Add Rule;
Transform an Incoming Claim;
Claim rule name — Name ID Format;
Incoming claim type — E-Mail Address;
Outgoing claim type — Name ID;
Outgoing name ID format — Transient Identifier.
﻿
Configuring rules for processing additional attributes to be transferred to SP
Edit the created rule named AttributeStatement:
Pass the Display-Name attribute to the SP (Passwork):
LDAP Attribute — Display-Name;
Outgoing Claim Type — write displayName.
Pass the E-Mail-Addresses attribute to the SP (Passwork):
LDAP Attribute — E-Mail-Addresses;
Outgoind Claim Type — write emailAddress.
﻿
Configuring and completing Single Sign-On (SSO) settings in Passwork
Filling in values "User attributes"
Authenticate in the Passwork web interface, go to — Settings and Users → SSO Settings and fill in the mapping attributes:
Attribute for email — emailAddress;
Attribute for full name — displayName;
Filling in values "Identity Provider → Passwork"
Open AD FS Management → stand on the AD FS directory → Edit Federation Service Properties:
﻿
Copy address — Federation Service identifier → http://ad-fs.passwork.local/adfs/services/trust:
﻿
Open — Settings and Users → SSO Settings and fill in the values:
Identifier (Entity ID) — http://ad-fs.passwork.local/adfs/services/trust
Reply URL — https://ad-fs.passwork.local/adfs/ls
Logout URL — https://ad-fs.passwork.local/adfs/ls/?wa=wsignout1.0
Filling in value "Certificate"
Open and export the generated SSL certificate in base64 format — AD FS Management → Service → Certificates → Token-signing:

﻿
Open the exported SSL certificate using Notepad, copy and place it in the appropriate field — Settings and Users → SSO Settings.
Filling in value "Advanced settings"
Put the following content in JSON format:
json
{
	"sp": {
		"entityId": "https://passwork.example.com/api/v1/sso/metadata",
		"assertionConsumerService": {
			"url": "https://passwork.example.com/api/v1/sso/acs"
		},
		"singleLogoutService": {
			"url": "https://passwork.example.com/api/v1/sso/sls"
		},
		"NameIDFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
	}
}
{
	"sp": {
		"entityId": "https://passwork.example.com/api/v1/sso/metadata",
		"assertionConsumerService": {
			"url": "https://passwork.example.com/api/v1/sso/acs"
		},
		"singleLogoutService": {
			"url": "https://passwork.example.com/api/v1/sso/sls"
		},
		"NameIDFormat": "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
	}
}
﻿
Replace the passwork.example.com domain in the URLs with the domain of your Passwork server.
Open the authentication window in the Passwork web interface and log in via SSO to verify the correct configuration:
﻿
﻿
Updated 28 Feb 2025
Did this page help you?
Configuring SSO with Keycloak
Configuring SSO with Microsoft Entra ID (Azure AD)
Configuring SSO with AD FS

Adding the trust relationship of the verifying party

Configuring rules for processing requests from SP (Passwork) in IDP (AD FS)

Configuring processing rules for [email protected] format

Configuring processing rules for username format

Configuring rules for processing additional attributes to be transferred to SP

Configuring and completing Single Sign-On (SSO) settings in Passwork

Filling in values "User attributes"

Filling in values "Identity Provider → Passwork"

Filling in value "Certificate"

Filling in value "Advanced settings"
