Set up a WS-Federation provider with AD FS
Active Directory Federation Services (AD FS) is one of the WS-Federation identity providers you can use to authenticate visitors to your Power Pages site. You can use any provider that conforms to the WS-Federation specification.
This article describes the following steps:
Important
The steps for setting up AD FS might vary depending on the version of your AD FS server.
Set up AD FS in Power Pages
Set AD FS as an identity provider for your site.
In your Power Pages site, select Set up > Identity providers.
If no identity providers appear, make sure External login is set to On in your site's general authentication settings.
Select + New provider.
Under Select login provider, select Other.
Under Protocol, select WS-Federation.
Enter a name for the provider.
The provider name is the text on the button that users see when they select their identity provider on the sign-in page.
Select Next.
Under Reply URL, select Copy.
Don't close your Power Pages browser tab. You'll return to it soon.
Create an AD FS relying party trust
In Server Manager, select Tools, and then select AD FS Management.
Select Trust Relationships > Relying Party Trusts.
Select Add Relying Party Trust.
Select Start.
Select Enter data about the relying party manually, and then select Next.
Enter a name; for example, https://portal.contoso.com/.
Select Next.
Select AD FS 2.0 profile, and then select Next.
On the Configure Certificate page, select Next.
Select Enable support for the WS-Federation Passive protocol.
Under Relying party WS-Federation Passive protocol URL, enter the reply URL you copied. AD FS requires that the website run HTTPS, not HTTP.
Select Next.
On the Configure Identifiers page, enter your site's URL, and then select Add.
You can add more identities for each additional relying party website if needed. Users can authenticate using any available identities.
Select Next.
On the Configure Multi-factor Authentication Now? page, select I do not want to configure multi-factor authentication settings for this relying party trust at this time.
On the Choose Issuance Authorization Rules page, select Permit all users to access this relying party, and then select Next.
Review the trust settings, and then select Next.
Select Close.
In Edit Claim Rules, select one the following tabs, depending on the trust you're editing and in which rule set you want to create the rule:
- Acceptance Transform Rules
- Issuance Transform Rules
- Issuance Authorization Rules
- Delegation Authorization Rules
Select Add Rule.
In the Claim rule template list, select Transform an Incoming Claim, and then select Next.
Enter or select the following values:
Claim rule name: Transform Windows account name to Name ID
Incoming claim type: Windows account name
Outgoing claim type: Name ID
Outgoing name ID format: Unspecified
Select Pass through all claim values.
Select Finish, and then select OK.
Finish setting up the provider
After you set up the AD FS relying party trust:
See also
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for