In order to use ADFS SAML 2.0 Protocol with the DAM Center (DC), some extra configuration is required.

*It is important to understand that we are using the claims as defined here: https://docs.microsoft.com/en-us/dotnet/api/system.security.claims.claimtypes?view=netframework-4.7.2.

Therefore, we need the attributes that are returned to use those Names. Especially email and name is relevant. 

Open

SAML 2.0 terminology can differ between Identity Providers. Digizuite has achieved SAML 2.0 integration with Okta & Ping, but we do have most experience with the ADFS setup which is described here.

Questions to ask about the Identity Provider:

1. Ask the customer for a Federation XML which can be included in the Identity Provider XML as presented below (metadataLocation="....").

2. If no Federation XML is there then ask for entityId="......." signOnUrl=".........."

3. Do you need a specific signing certificate or is it already included in the received Federation XML?

What to provide the customer?

1. The Entity ID is required by the customer (https://DC_URL/DigizuiteCore/LoginService)

2. Assertion Consumer Service (Acs)  (https://DC_URL/DigizuiteCore/LoginService)

   1. This validates the responses from the Identity Provider

3. Return URL  (https://DC_URL/DigizuiteCore/LoginService/Saml2)

*Also, please consider the other configuration options in Section 3 below.

SAML2 is designed to handle situations where you want to use SSO, but your server is not in the same hosting environment as the domain the user is in.

At the moment we only support ADFS with SAML 2.0 Protocol in the following products:

• Digizuite™ Media Manager

• Digizuite™ DAM Center

• Digizuite Mobile

• Office Connector

• Creative Cloud Connector

In order to set up SAML2 ADFS on DC, you need to have a running ADFS server. Instructions on installation can be found in the Configure ADFS with SAML 2.0 Protocol on Windows Server 2012 R2 document.

Currently, users will automatically be created when redirected from SAML2.

To configure Saml2 on the Digizuite side, go to Media Manager, go to settings => SSO

In the SSO type dropdown, select "Saml2"

For the template member Id put the ID of the member to use as a template user. If 0 is provided, the default template member in the Digizuite is used. 

Set "Group Sync Level". Use the tooltips in Media Manager for what the specific levels does. 

Set "name" to something arbitrary. It is only used for Human reference.

Specify the Entity ID you gave the customer above. 

For signing behavior pick whichever makes sense based on the tooltips. Most of the time you likely want "IfIdpWantAuthnRequestsSigned"

Set "Ignore Authentication Context in Response" as needed. It's highly likely this can be left "off"

Next configure the "Entity ID" and "Metadata location" of the identity provider based on what the customer gave you above. 

If you need a signing certificate, first add the certificate using the "Certificate configuration" menu on the right. Once the certificate has been added, it can be picked from the "Signing certificate" dropdown under "SSO configuration". 

Next press "Save". Once it's done saving you should be able to "Activate" the configuration. 

Once the UI says "Latest is active", then Saml2 should be working.