Configuring ADFS and LDAP for OAuth

Follow these procedures to configure Active Directory Federated Services (ADFS) and LDAP for an OAuth authentication option.

Export Certificate

Blow are the steps to export a certificate for CT-VL:

1. Open Server Manager.

2. Click Tools and select ADFS Management.

3. Click Certificates.

4. Double-click on Token-signing certificate.

5. In the certificate window, select Details tab.

6. Click Copy to File...

7. Click Next.

8. Select Base64 format and click Next.

9. Enter file name.

Add an Application Group

Below are the steps to add an application group:

1. Open Server Manager.

2. Click Tools and select ADFS Management.

3. Right click Application Groups and select Add Application Group wizard.

4. Enter name and select Native application accessing a web API.

5. Copy Client Identifier to a template for later use.

6. Enter your CT-VL login URL in Redirect URI field (https:///login) and click Add.

7. Click Next.

8. Enter the same CT-VL URI as entered in previous step in the Identifier field and click Add.

9. Click Next.

10. Use default (Permit everyone) and click Next.

11. Click Next on the review page.

12. Click Close.

Add Properties to a New Group

Below are the steps to add properties to a new group:

1. Double-click on the desired new group.

2. Select - Web API and click Edit.

3. Select Issurance Transform Rules and click Add Rules.

4. Select Claim rule template: Send LDAP Attributes as Claims.

5. Click Next.

6. Enter a rule name.

7. Add the following rules:

   • Token-Groups - Unqualified Names : Group

   • User-Principal-Name : UPN

   • SAM-Account-Name : Name

   • Surname : Surname

   • Given-Name : Given Name

8. Click Finish.

9. Click OK.

Test ADFS Authentication

To test ADFS authentication:

curl -k -X POST https://<adfs server>/adfs/oauth2/token -d
'grant_type=password&username=<user>&password=<password>&client_id=<clien
t id>5&resource=https%3A%2F%2Fmickeymouse'

The expected response is:

{"access_token":"eyJ0eXA ... mVSpzmW-FBDlg"}