---
title: "SSO - Configuring ADFS"
canonical: "https://support.appfire.com/space/SSO/18153878/SSO%20-%20Configuring%20ADFS"
format: markdown
---
> Macro (aura-html)

The following example shows how you can configure your IDP (ADFS in this case) to prepare your IDP for Global SSO. Note that this is an example, and you can decide to set up your system in a different way. 

> ⚠️ Here we assume that you possess the necessary knowledge of your IDP. If you need more information, refer to the IDP documentation.

To configure ADFS:

1. [Create replying party trust](https://appfire.atlassian.net/wiki/spaces/SSO/pages/18153878)
2. [Configure claim rules](https://appfire.atlassian.net/wiki/spaces/SSO/pages/18153878)

# Creating relying party trust

1. Connect to the server through the RDP and go to **AD FS Management**.
2. Create a new relying party trust. To do this, right click the **Relying Party Trusts** and select **Add Relying Party Trust** menu item.  
> Macro (inline-media-image)
3. On the **Welcome** tab, select **Claims aware** and click **Start**.  
> Macro (inline-media-image)
4. On the **Select Data Source** tab, select **Enter data about the relying party manually**.  
> Macro (inline-media-image)
5. On the next tab, enter a display name. This name will be displayed as a site on the login page if you use the IDP initiated SSO. This name will also be shown on the Administration pages.  
> Macro (inline-media-image)
6. Skip the **Configure Certificate** tab by clicking the **Next** button.  
> Macro (inline-media-image)
7. On the **Configure URL** tab let's choose **Enable support for the SAML 2.0 WebSSO protocol** and enter SSO service URL. It should be a URL based on the following pattern format:  
**https://$**<span style="color: #0000ff">**{your.domain.com}**</span>**/$**<span style="color: #0000ff">**{application_path_if_exists}**</span>**/plugins/servlet/globalconsumer.**  
> Macro (inline-media-image)
8. On the **Configure Identifiers** tab, put the same URL to the **Relying party trust identifiers** field and click **Add**.  
> Macro (inline-media-image)
9. On the **Choose Access Control Policy** tab, click **Next**.  
> Macro (inline-media-image)
10. On the **Ready to Add Trust** and click **Next**.  
> Macro (inline-media-image)

That's it, your configuration is ready.


# Configuring claim rules

Global SSO requires two parameters in the SAML assertion:

1. Name ID
2. Username attribute - you can use any naming and then just set a name attribute field on the SSO plugin configuration page. And this attribute should correspond to a username from a SAML Assertion.

Here is an example on how we can send these parameters throught the SAML Assertion using claim rules:

1. Go to the claim rules configuration. For instance, right click the relying party trust and select **Edit Claim Issuance Policy**.  
> Macro (inline-media-image)
2. Add a **Send LDAP Attribute as Claims** rule:  
> Macro (inline-media-image)

  
  
In our example it will have the following properties:  
> Macro (inline-media-image)
3. In the second rule, map the **Name** attribute (see screenshot above) to the **Name ID** in the outgoing claim:  
> Macro (inline-media-image)
4. And in the the last rule, map the incoming claim type (**Given Name**) to the outgoing claim type (**Given Name**). It will be our username.  
> Macro (inline-media-image)

In this case if we want to use **Given Name** as a username property, according to the ADFS types specifications we should specify "**http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname**" as a name attribute in our SSO configuration on the plugin side (Atlassian application >** Administration > SAML Consumer Configuration** page). We will have a configuration like in the example below: 

![image](media://ba8d9e5c-8d1a-4734-8fb1-9cb423adac6f)


> ℹ️ **Helpful tips**
> ℹ️ 
> ℹ️ - Login URL for SP Initiated SSO:   
> ℹ️ **https://${your.domain.com}/${application_path_if_exists}/plugins/servlet/sso/consumer/redirect?RelayState=${your.domain.com}/${application_path_if_exists}**
> ℹ️ - Login URL for IDP Initiated SSO:   
> ℹ️ **https://${your.domain.com}/adfs/ls/idpinitiatedsignon.aspx**

> ❌ **NameId Policy for SP initiated SSO**
> ❌ 
> ❌ Global SSO supports only Unspecified NameIDPolicy format which is supported by SAML 2.0 Core:  
> ❌ **URI: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified**


# Troubleshooting

In case you have any problems, to debug SSO we suggest to enable a DEBUG mode for our plugin inside your Atlassian application. To do this:

1. Go to the **Logging and Profiling** section of your application and configure the **com.cprime.jira **custom package rule, like in the example below:  
> Macro (inline-media-image)
2. Then you should see smth like this in your logs:

##### **log output**

```ruby
... /plugins/servlet/sso/consumer/redirect [c.c.jira.utils.SamlAppSettings] assertionConsumerServiceUrl is set to : https://${your.domain}/jira/plugins/servlet/globalconsumer
... /plugins/servlet/sso/consumer/redirect [c.c.jira.utils.SamlAppSettings] issuer is set to : https://${your.domain}/jira/plugins/servlet/globalconsumer
... /plugins/servlet/sso/consumer/redirect [c.c.jira.utils.SamlAccountSettings] IDP for SSO is set to : https://adfs-dev.cprime.io/adfs/ls/
... /plugins/servlet/sso/consumer/redirect [c.c.jira.utils.SamlAuthRequest] Formed SAML request for idp: <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
ID="_845a7fd0-8fa6-45ec-afb4-a309c2b25dd3" Version="2.0" IssueInstant="2018-01-04T10:31:57Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
AssertionConsumerServiceURL="https://${your.domain}/jira/plugins/servlet/globalconsumer"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
https://${your.domain}/jira/plugins/servlet/globalconsumer</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" 
AllowCreate="true"/></samlp:AuthnRequest>
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] atlassian.sso_req is: ${your.domain}/jira/
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] SAMLConsumer servlet called with relay state: https://${your.domain}/jira/
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] Certificate is read to validate SAML responses
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] Content read of file /opt/atlassian/jira/${your.domain}/atlassian-jira-software-7.3.5-standalone/work/Catalina/localhost/jira/sso/sso.ser: 
MIIC4DCCAcigAwIBAgIQHoPnJO+nIolP3A467O45PzANBgkqhkiG9w0BAQsFADAsMSowKAYDVQQDEyFBREZTIFNpZ25pbmcgLSBhZGZzLWRldi5jcHJpbWUuaW8wHhcNMTcxMjE1MTkzMzE4WhcNMTgxMjE1MTkzMzE4WjAsMSowKAYDVQQDEyFBREZTIFNpZ25pbmcgLSBhZG
ZzLWRldi5jcHJpbWUuaW8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqh/By/T76TtNNVJURu16fPi+znfdvmyBH7/GaKws9n9FYMQdkSohe0hZBDOPB/LgR51SA1n1Pz7INVkDPiO5w48kLUTkER1d6FasV28zZCsGOnulugHO/gpwXQbVbZuxpwmf4xatOqVTh
h21kAF2VHcXkz5s+sQ2iX+qYDNmYc+ClmI7KKrIS+EtnHeyevg3xNnxdOj0br6aap/Cng0TV1EnjEyoKq9PQ3EZMwp5I39pmkH7NRus4toh61orhBn1sl/jCtYI31V8fxRroSLESZeJkSjH0dNYLOwi+lCg2adJqwi//fQPJlgMuaqVh4QVMV+/lZ6y0HHF4xWdOtLBbAgMBAA
EwDQYJKoZIhvcNAQELBQADggEBAFARwcXbq3YS/VlJmvUE4c33K+khxOqddg2Fo9+dTQoH7CRAxIRPpBmpw4OYWeuVG+t+Nn4+Le6Si+oW8RXn+xCh5XSIF+2dZehH7tGlgzK/OTKtUxhXYfgA93DJFnLHaNKQhDpESrqdr2YwE37tYlQfCby9J2nZRYieW7mqleXDHMXqIEBX
4xhduAgp3p7tmkBCnquRNUnHfgNBFPD4kHtu5+ONYHqe0nBKvSprEfRflTdEYUtFsmuH17VlKHvExFsrBQffFFhFK/iguBlF3LwaJz1R4W8wgRkHZ1tvM8sD0NvpT2YEXAqvD17w7BwHIug1imSHgQUnWB9xqK8IU8o=
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] Certificate set for request.
... /plugins/servlet/globalconsumer [c.c.jira.utils.SamlAccountSettings] Certificate is set to : MIIC4DCCAcigAwIBAgIQHoPnJO+nIolP3A467O45PzANBgkqhkiG9w0BAQsFADAsMSowKAYDVQQDEyFBREZTIFNpZ25pbmcgLSBhZGZzLWRld
i5jcHJpbWUuaW8wHhcNMTcxMjE1MTkzMzE4WhcNMTgxMjE1MTkzMzE4WjAsMSowKAYDVQQDEyFBREZTIFNpZ25pbmcgLSBhZG
ZzLWRldi5jcHJpbWUuaW8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqh/By/T76TtNNVJURu16fPi+znfdvmyBH7/GaKws9n9FYMQdkSohe0hZBDOPB/LgR51SA1n1Pz7INVkDPiO5w48kLUTkER1d6FasV28zZCsGOnulugHO/gpwXQbVbZuxpwmf4xatOqVTh
h21kAF2VHcXkz5s+sQ2iX+qYDNmYc+ClmI7KKrIS+EtnHeyevg3xNnxdOj0br6aap/Cng0TV1EnjEyoKq9PQ3EZMwp5I39pmkH7NRus4toh61orhBn1sl/jCtYI31V8fxRroSLESZeJkSjH0dNYLOwi+lCg2adJqwi//fQPJlgMuaqVh4QVMV+/lZ6y0HHF4xWdOtLBbAgMBAA
EwDQYJKoZIhvcNAQELBQADggEBAFARwcXbq3YS/VlJmvUE4c33K+khxOqddg2Fo9+dTQoH7CRAxIRPpBmpw4OYWeuVG+t+Nn4+Le6Si+oW8RXn+xCh5XSIF+2dZehH7tGlgzK/OTKtUxhXYfgA93DJFnLHaNKQhDpESrqdr2YwE37tYlQfCby9J2nZRYieW7mqleXDHMXqIEBX
4xhduAgp3p7tmkBCnquRNUnHfgNBFPD4kHtu5+ONYHqe0nBKvSprEfRflTdEYUtFsmuH17VlKHvExFsrBQffFFhFK/iguBlF3LwaJz1R4W8wgRkHZ1tvM8sD0NvpT2YEXAqvD17w7BwHIug1imSHgQUnWB9xqK8IU8o=
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] Certificate & relay state set to process SAML Response
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] SAML response after decoding: <samlp:Response ID="_fbe15c73-32b4-45c8-8abc-b01dca90bb28" Version="2.0" IssueInstant="2018-01-04T10:27:36.70
6Z" Destination="https://${your.domain}/jira/plugins/servlet/globalconsumer" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" InResponseTo="_845a7fd0-8fa6-45ec-afb4-a309c2b25dd3" 
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://adfs-dev.cprime.io/adfs/services/trust</Issuer><samlp:Status><samlp:StatusCode 
Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status><Assertion ID="_87f2b508-5610-4988-a893-dc61492d3e5e" IssueInstant="2018-01-04T10:27:36.706Z" Version="2.0" 
xmlns="urn:oasis:names:tc:SAML:2.0:assertion"><Issuer>http://adfs-dev.cprime.io/adfs/services/trust</Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /><ds:Reference 
URI="#_87f2b508-5610-4988-a893-dc61492d3e5e"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /><ds:DigestValue>NSlyIugU8lR6KoSND7IJ/dLkBBePO7a0NaoGzGeE2Gc=</ds:DigestValue></ds:Reference></ds:SignedInfo>
<ds:SignatureValue>FXg8kbUCGombngwWAhl1pJikbHscxpMbCdLSLpsB+U9fmngvcWBsNJnFl3ChSfk+VBQOYEKtkrxYfGDX94V3n+7CeWMJ007+jC1tm4/xpm4W71t6uyxBU2EoEqqB4HZGgHi5yAlWGHYFRT8RkpCircAsiJKwttcK34mFhSqRxthzkKLNbPlDgZd/2XebgyT
w5VEE0IBMk0kgRbjlIxWbcuXkrg6Hk+MNh7g5oNI/Xs5N2EIqE+l9lbewgCfTV+AP9lGwfyhasIIu58i6Z22tmers5KNRG1hv/Js4HZ1ExcDLfSKO7qJ45y2hRCunBAhmLPPnhnxpakciSidjFlysvw==</ds:SignatureValue>
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"><ds:X509Data><ds:X509Certificate>MIIC4DCCAcigAwIBAgIQHoPnJO+nIolP3A467O45PzANBgkqhkiG9w0BAQsFADAsMSowKAYDVQQDEyFBREZTIFNpZ25pbmcgLSBhZGZzLWRldi5jcHJpbWUuaW8w
HhcNMTcxMjE1MTkzMzE4WhcNMTgxMjE1MTkzMzE4WjAsMSowKAYDVQQDEyFBREZTIF
NpZ25pbmcgLSBhZGZzLWRldi5jcHJpbWUuaW8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCqh/By/T76TtNNVJURu16fPi+znfdvmyBH7/GaKws9n9FYMQdkSohe0hZBDOPB/LgR51SA1n1Pz7INVkDPiO5w48kLUTkER1d6FasV28zZCsGOnulugHO/gpwXQbVbZux
pwmf4xatOqVThh21kAF2VHcXkz5s+sQ2iX+qYDNmYc+ClmI7KKrIS+EtnHeyevg3xNnxdOj0br6aap/Cng0TV1EnjEyoKq9PQ3EZMwp5I39pmkH7NRus4toh61orhBn1sl/jCtYI31V8fxRroSLESZeJkSjH0dNYLOwi+lCg2adJqwi//fQPJlgMuaqVh4QVMV+/lZ6y0HHF4xWdO
tLBbAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAFARwcXbq3YS/VlJmvUE4c33K+khxOqddg2Fo9+dTQoH7CRAxIRPpBmpw4OYWeuVG+t+Nn4+Le6Si+oW8RXn+xCh5XSIF+2dZehH7tGlgzK/OTKtUxhXYfgA93DJFnLHaNKQhDpESrqdr2YwE37tYlQfCby9J2nZRYieW7mqleXDH
MXqIEBX4xhduAgp3p7tmkBCnquRNUnHfgNBFPD4kHtu5+ONYHqe0nBKvSprEfRflTdEYUtFsmuH17VlKHvExFsrBQffFFhFK/iguBlF3LwaJz1R4W8wgRkHZ1tvM8sD0NvpT2YEXAqvD17w7BwHIug1imSHgQUnWB9xqK8IU8o=</ds:X509Certificate></ds:X509Data>
</KeyInfo></ds:Signature><Subject><NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">CPRIME\someUser</NameID><SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<SubjectConfirmationData InResponseTo="_845a7fd0-8fa6-45ec-afb4-a309c2b25dd3" NotOnOrAfter="2018-01-04T10:32:36.706Z" Recipient="https://${your.domain}/jira/plugins/servlet/globalconsumer" />
</SubjectConfirmation></Subject><Conditions NotBefore="2018-01-04T10:27:36.706Z" NotOnOrAfter="2018-01-04T11:27:36.706Z"><AudienceRestriction>
<Audience>https://${your.domain}/jira/plugins/servlet/globalconsumer</Audience></AudienceRestriction></Conditions><AttributeStatement>
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"><AttributeValue>***@cprime.local</AttributeValue>
</Attribute></AttributeStatement><AuthnStatement AuthnInstant="2018-01-04T10:26:22.098Z" SessionIndex="_87f2b508-5610-4988-a893-dc61492d3e5e"><AuthnContext>
<AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AuthnContextClassRef></AuthnContext></AuthnStatement></Assertion></samlp:Response>
... /plugins/servlet/globalconsumer [c.c.jira.saml.Response] Basic validation completed
... /plugins/servlet/globalconsumer [c.c.jira.saml.Response] Audience validation completed : https://${your.domain}/jira/plugins/servlet/globalconsumer
... /plugins/servlet/globalconsumer [c.c.jira.saml.Response] Traversing subjects
... /plugins/servlet/globalconsumer [c.c.jira.saml.Response] Method value validated
... /plugins/servlet/globalconsumer [c.c.jira.saml.Response] SubjectConfirmation child elements :1
... /plugins/servlet/globalconsumer [c.c.jira.saml.Response] Traversing childs : SubjectConfirmationData
... /plugins/servlet/globalconsumer [c.c.jira.saml.Response] Validating SubjectConfirmationData
... /plugins/servlet/globalconsumer [c.c.jira.saml.Response] Validating recipient
... /plugins/servlet/globalconsumer [c.c.jira.saml.Response] Validated recipient
... /plugins/servlet/globalconsumer [c.c.jira.saml.Response] SAML Assertion has not expired
... /plugins/servlet/globalconsumer [c.c.jira.saml.Response] Valid subject confirmation completed
... /plugins/servlet/globalconsumer [c.c.jira.saml.Response] Signature verification completed : true
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] The signature of the SAML Response is valid. The source is trusted.
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] Extracted assertion from SAML Response NameId: CPRIME\someUser, username: someUser@cprime.local
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] Attempt to generate SSO session with parameters, Remote Address: 127.0.0.1, X-Forwarded-For: ***
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] Generated session for user successfully: someUser@cprime.local
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] Creating user context with details for SSO: someUser@cprime.local;1515061917
... /plugins/servlet/globalconsumer [c.c.jira.utils.EncryptionUtil] Generated encoded encryptedString: c1MiyMzQ3JLmhS012CRYx4XWgy+NeAFKEKLNAGULs4rRGCV5RbWMgFrawjLnVCM27IXcmJOswLNOCNoOw60LBJWeEbgAT/4I0MRJz
QELN/BStR0k87KGYqpmxn8sf/hvTBV2wlluPusdEya9tcLAg5uqfqPjbWrgLoYT6am7pdORthSWUBMX32QsdUW3bnwUJQVhILZndyStpkrzQ
uqaCnqJXud68xnilHYlbKEtxNT1zfeo5E9kK1kKhHWXL/u2ei7gB23A+i2hoxlN5soio3wt2o8AAfPHBA7qYysQJPVGINOJTXxdLe43gCTyHNRSAKbkDKHJq1ZEvmJOCoUUDw==
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] Creating cookie: c1MiyMzQ3JLmhS012CRYx4XWgy+NeAFKEKLNAGULs4rRGCV5RbWMgFrawjLnVCM27IXcmJOswLNOCNoOw60LBJWeEbgAT/4I0MRJzQELN/BStR0k87KGYq
pmxn8sf/hvTBV2wlluPusdEya9tcLAg5uqfqPjbWrgLoYT6am7pdORthSWUBMX32QsdUW3bnwUJQVhILZndySt
pkrzQuqaCnqJXud68xnilHYlbKEtxNT1zfeo5E9kK1kKhHWXL/u2ei7gB23A+i2hoxlN5soio3wt2o8AAfPHBA7qYysQJPVGINOJTXxdLe43gCTyHNRSAKbkDKHJq1ZEvmJOCoUUDw==
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] Cookie Set: c1MiyMzQ3JLmhS012CRYx4XWgy+NeAFKEKLNAGULs4rRGCV5RbWMgFrawjLnVCM27IXcmJOswLNOCNoOw60LBJWeEbgAT/4I0MRJzQELN/BStR0k87KGYqpmxn8sf/hvTBV2wlluPusdEya9tcLAg5uqfqPjbWrgLoYT6am7pdORthSWUBMX32QsdUW3bnwUJQVhILZndyS
tpkrzQuqaCnqJXud68xnilHYlbKEtxNT1zfeo5E9kK1kKhHWXL/u2ei7gB23A+i2hoxlN5soio3wt2o8AAfPHBA7qYysQJPVGINOJTXxdLe43gCTyHNRSAKbkDKHJq1ZEvmJOCoUUDw==
... /plugins/servlet/globalconsumer [c.c.jira.servlet.SAMLConsumer] Redirecting to targetService: https://${your.domain}/jira/
```

# See also

- [Preparing the certificate for SAML SSO Client](https://appfire.atlassian.net/wiki/spaces/SSO/pages/18153717/GL-SSO+3.0+-+Preparing+certificate+for+SAML+SSO+Client)
- [Configuring SAML sign-out](https://appfire.atlassian.net/wiki/spaces/SSO/pages/18153788)