SAML SSO with ADFS

Active Directory Federation Services (ADFS) is Microsoft's on-premises identity provider that enables federated identity and single sign-on across applications. With SAML SSO configured between ADFS and Document360, your team members and readers can sign in to Document360 using their existing Active Directory credentials.

What you can do with ADFS as your IdP

Before you begin

• You have administrative access to both Document360 and your ADFS server.
• You have Owner or Admin access in your Document360 project.
• Open Document360 and ADFS in two separate browser tabs. You will need to switch between them multiple times during setup.

Step 1: Create a Relying Party Trust in ADFS

Add the application in ADFS

1. Log in to the ADFS Management console on your ADFS server.
2. In the ADFS Management console, navigate to Relying Party Trusts.
3. Right-click Relying Party Trusts and select Add Relying Party Trust.
4. In the Add Relying Party Trust Wizard, choose Claims aware and click Start.
5. Select Enter data about the relying party manually and click Next.
6. Provide a display name (for example, "Document360 SAML SSO") and click Next.
7. In the Configure Certificate step, click Next (you can skip this if not using a certificate).
8. Under Configure URL, select Enable support for the SAML 2.0 Web SSO protocol.

Step 2: Configure ADFS with Document360 Service Provider parameters

Get the SP parameters from Document360

1. Open Document360 in a separate tab.
2. Navigate to Settings () > Users & permissions > SSO Configuration.
3. Click Create SSO.

4. Select ADFS as your Identity Provider (IdP) to navigate to the Configure the Service Provider (SP) page automatically.

5. On the Configure the Service Provider (SP) page, select the SAML radio button as the protocol.
6. A set of parameters will be displayed to complete the SAML configuration in ADFS.

Enter the Document360 parameters in ADFS

Enter the Document360 parameters into the corresponding fields in the Configure URL and Identifiers steps in ADFS using the mapping below.

8. Click Next and complete the remaining steps in the wizard, such as setting up multi-factor authentication if required, and permitting all users to access the application.
9. Review your settings and click Next to add the relying party trust.
10. On the final screen, check the box for Open the Edit Claim Rules dialog and click Close.

Step 3: Configure claim rules in ADFS

Add claim rules

1. In the Edit Claim Rules dialog, click Add Rule.
2. Select Send LDAP Attributes as Claims as the rule template and click Next.
3. Provide a name for the claim rule (for example, "Send LDAP Attributes").
4. Configure the following:
   • Attribute Store: Select Active Directory.
   • Mapping:
     • LDAP Attribute: User-Principal-Name | Outgoing Claim Type: Name ID
     • LDAP Attribute: E-Mail-Addresses | Outgoing Claim Type: Email-Addresses
     • LDAP Attribute: Display-Name | Outgoing Claim Type: Name
5. Click Finish to add the rule.
6. Click Apply to save your changes and close the dialog.

Step 4: Complete the SSO configuration in Document360

Configure the Identity Provider in Document360

1. Return to the Document360 tab displaying the Configure the Service Provider (SP) page and click Next to navigate to the Configure the Identity Provider (IdP) page.

2. The Configure an existing connection field allows you to inherit an SSO configuration that already has SCIM enabled from a parent project. By selecting this option, the current SSO configuration becomes the child and automatically inherits the SCIM settings from the parent project.
3. Enter the corresponding values from your ADFS configuration using the mapping below.

4. Download the X.509 Certificate from ADFS and upload it to the SAML Certificate field in Document360.

5. Toggle the Allow IdP initiated sign in option on or off based on your project needs.
6. Click Next to proceed to the SCIM provisioning page.

Step 5: Configure SCIM provisioning

SCIM provisioning allows you to automate user and reader lifecycle management between ADFS and Document360. Since ADFS does not natively support SCIM, this requires a third-party tool or a custom-built integration.

If you do not need SCIM provisioning, skip to Step 6: More settings.

Enable SCIM in Document360

1. Turn on the Enable SCIM provisioning toggle.

2. A confirmation dialog appears. Review the terms, select the checkbox, and click Agree.
3. The parameters required to complete the SCIM configuration will then be displayed.

4. Enter the required parameters from Document360 into the corresponding fields in your custom app.

Assign default role and groups in Document360

1. In the Default role field, the role is set to Contributor by default. You can change this from the dropdown if needed.
2. In the User groups and Reader groups fields, select the groups you want to add. Multiple groups can be added, and they will inherit the default role you selected earlier.
3. Click Next to navigate to the More settings page.

Step 6: More settings

Configure SSO name and login options

1. In the SSO name field, enter a name for the SSO configuration.
2. In Customize login button, enter the text for the login button displayed to users.
3. Auto assign reader group — this option is only available for existing SSO configurations. For newly created SSO configurations, this toggle will not be displayed as SCIM automatically provisions users and groups. Learn more about Auto assign reader group.
4. Enable Sign out idle SSO user if needed, and toggle based on your requirements.

5. Click Create to complete the SAML SSO configuration.

Managing users in ADFS

To view readers added through your ADFS integration:

1. In Document360, navigate to Settings () > Users & permissions > Readers & groups.
2. Select the reader to navigate to their reader profile.

Readers provisioned via SCIM will display an SSO-SCIM badge next to their name.

Manage content access of readers, users, and groups

The default content role assigned to any new user, reader, or group is based on what was configured during SCIM provisioning setup. Permissions will be set to None by default but can be updated at any time.

1. Select the desired reader and click Manage Content Access.
2. Choose the desired access level from the dropdown and click Update.

Best practices

• Export the certificate in Base-64 encoded (.CER) format. The default DER encoded format from ADFS is not supported by Document360. Always select Base-64 encoding when exporting the X.509 certificate.
• Use a third-party tool for SCIM. ADFS does not natively support SCIM provisioning. Plan your user provisioning approach before enabling SCIM in Document360.
• Configure claim rules carefully. Ensure all three LDAP attribute mappings (Name ID, Email-Addresses, and Name) are configured correctly. Missing or incorrect claims will cause authentication failures.
• Test with a single user first. Before rolling out SSO to all users, test the configuration with one user to verify that claim rules, certificates, and URLs are all working correctly.

FAQ