---
title: "ADFS"
canonical: "https://support.appfire.com/space/FD/1802010941/ADFS"
format: markdown
---
> ⚠️ These instructions apply only to Flow Enterprise Server.

Below is a step-by-step guide for setting up an SSO connection to Flow Enterprise Server using ADFS.

1. From the top navigation of Flow, click **Settings**.
2. In the left navigation, click **SSO** under **User Management**.
3. Click **Add SAML integration**.
4. In the Configure SAML modal, fill out the Metadata field. ADFS has a metadata URL, generally formatted as: `https://<base_url>/FederationMetadata/2007-06/FederationMetadata.xml`. Copy/paste the URL or the raw XML into this field.
5. Fill in the Entity ID/Sign in URL field with the URL you will use to log in with after you configure your integration. You can use your organization name or something else, but it must be unique.
6. Enable optional settings if desired:
  1. **Manage Roles within Flow**: If you want Flow to manage your roles, check this box.
  2. **Merge new users on Email**: If you already have users in Flow with non-SSO logins, check this box. This option automatically deletes previous logins and forces all existing users to log in via your SSO platform.
  3. Check **Merge New Users on Email** if you already have users in Flow using non-SSO logins. This automatically deletes previous logins and forces existing users to sign in via SSO.
  4. In the **Full name** field, input **FirstName** **LastName**. These inputs are case sensitive and must match this exactly.
  5. In the **Email** field, input **E-Mail**.
7. Copy the Entity ID/Sign in URL from Flow and open ADFS. Follow the steps to [manually create a relying party trust in ADFS (external site, opens in new tab)](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-relying-party-trust).
  1. Set the display name to Flow.
  2. Only click the check box for **Enable support for the SAML 2.0 WebSSO protocol**. Do not check **Enable support for the WS-Federation Passive protocol**.
  3. Add the Entity ID/Sign in URL as the Relying party SAML 2.0 SSO service URL.
  4. Add the Entity ID/Sign in URL as the Relying party trust identifier on the **Configure identifiers** page.
  5. When finished, close the wizard.
8. The Edit Claim rules wizard should automatically open.
9. Next, [create a rule to send LDAP attributes as claims (external site, opens in new tab)](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-rule-to-send-ldap-attributes-as-claims). Create the following mappings of LDAP attributes to Outgoing claim types:
  - **Given-Name** to **FirstName**
  - **Surname** to **LastName**
  - **E-Mail Addresses** to **E-Mail**
  - **Token-groups - Unqualified Names** to **Roles**
  - **E-Mail Addresses** to **Name ID**
    - Name ID is a required attribute to validate the SAML assertions from ADFS.