Active Directory Federation Services

Authenticating Ministry.Chat and Microsoft ADFS via SAML

It is possible to setup the authentication between Ministry.Chat and Active Directory Federation Services by setting up SAML authentication scenario.

Microsoft ADFS provides an IdP service which can be consumed by Ministry.Chat for authentication. Important: If you are using Active Directory without Federation Services, you should perform the user synchronization via LDAP only.

This document takes into consideration that your ADFS environment is deployed and running. For further info, please refer to this guide

The Ministry.Chat configuration should be done as follows:

1. Go to Administration -> SAML and configure the entry points and the IdP path

1. Add the private key certificate related to the ADFS server.

Important: ADFS uses .pfx certificate extensions (widely used on Windows landscapes) and Ministry.Chat uses .pem files. So, before setting the certificate here, it must be converted.

1. Set the Custom Authn Context and User Data Field Map according the scenario you have on your Active Directory Federation services

Important: The Custom Authorization context fields must match the authentication methods selected on ADFS. Microsoft Federation Services provides two authentication methods: Forms authentication and Windows Authentication.

• Forms authentication: If this option is selected as 'primary', a login form provided by ADFS will be called by the SAML assertion in order to perform the login operation. For this method, the recommended "Custom Authn Context" in Ministry.Chat should be urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

• Windows authentication: if this option is selected as 'primary', ADFS will expect the login assertions on Windows Domain level. In order to set a full SSO scenario between Ministry.Chat and ADFS, the recommended "Custom Authn Context" should be urn:federation:authentication:windows