Skip to main content

Create an OIDC federation for AD FS

  1. Configure federation on the AD FS side.
  2. Create a federation on the Servercore side.
  3. Add the Servercore federation ID to the AD FS federation.
  4. If you enabled automatic user creation when creating a federation on the Servercore side, configure user group mapping.

1. Configure federation on the AD FS side

  1. On the AD FS server, open Server Manager.

  2. Right-click the Application Group section and select Add Application Group.

  3. At the Welcome step:

    3.1. In the Name field, enter the federation name.

    3.2. In the Templates block, select the Server application accessing a web template.

    3.3. Click Next.

  4. At the Server application step:

    4.1. Copy and save the value in the Client Identifier field.

    4.2. In the Redirect URI field, enter https://api.servercore.com/v1/auth/federations/oidc/.

    4.3. Click Next.

  5. At the Configure Application Credentials step:

    5.1. Select the Generate shared secret checkbox. A secret will be generated.

    5.2. Click Copy to clipboard and save the secret value. You will not be able to view it later.

    5.3. Click Next.

  6. At the Apply Access Control Policy step:

    6.1. Select an access policy.

    6.2. Click Next.

  7. At the Configure Application Permissions step:

    7.1. In the Permitted scopes block, select the email, openid, profile checkboxes.

    7.2. Click Next.

  8. At the Summary step, click Next.

  9. At the Complete step, click Save.

2. Create a federation on the Servercore side

  1. In the control panel top menu, click IAM.

  2. Go to the Federations section.

  3. Click Add federation and select OpenID Connect (OIDC).

  4. In the Federation settings block:

    4.1. Enter the federation name.

    4.2. Optional: enter the federation description.

    4.3. Change the session lifetime or leave the default value (24 hours). The session defines the time during which a user remains authorized without the need for re-authentication. You can specify a value from 1 to 720 hours.

  5. In the IdP settings block:

    5.1. In the IdP Issuer field, enter the identity provider identifier — props.IdIssuer. Specify <idp_url> — your IDP URL.

    5.2. In the Client ID field, enter the identifier that you сохранили из поля Client Identifier when configuring the federation on the identity provider side at stage 1 in step 4.1.

    5.3. In the Client Secret field, enter the secret, который вы получили при настройке федерации on этапе 1 in шаге 5.2.

    5.4. In the Auth URL field, enter the link to the identity provider login page where users will be redirected for authentication via SSO — props.AuthUrl. Specify <idp_url> — your IDP URL.

    5.5. In the Token URL field, enter the token endpoint — props.TokenUrl. Specify <idp_url> — your IDP URL.

    5.6. In the JWSK URI field, enter the endpoint containing certificates — props.JwskUri. Specify <idp_url> — your IDP URL.

    5.7. To create users automatically upon their first login to the control panel via SSO, select the Auto-create users checkbox.

    If the checkbox is selected, you will need to configure user group mapping. Users will be created with the permissions you specify when configuring the mapping. If you enable auto-creation of users without configuring mapping, users will be created without permissions and will not have access to the Control Panel.

    If you do not select the Auto-create users checkbox, you will need to add users manually.

  6. Click Create Federation.

3. Add the Servercore federation ID to the AD FS federation

  1. On the AD FS server, open Server Manager.
  2. In the Application Group section, open the federation you configured on the AD FS side in step 1.
  3. In the Redirect URI field, enter https://api.servercore.com/v1/auth/federations/oidc/<federation_id>/callback. Specify <federation_id> — the federation ID on the Servercore side, which can be found in the Control panel: in the top menu, click IAM → Federations → federation row → ID.
  4. Click Save.

4. Configure user group mapping

You must configure group mapping if you enabled automatic user creation during the creation of a federation on the Servercore side in step 2. Use the Configure group mapping subsection of the User Group Mapping guide.