Overview<\/h3>\n\nTopTeam<\/i> supports Web single sign-on (SSO) using Active Directory<\/i> with ADFS and SAML.<\/font> ADFS is a Microsoft <\/i>service for Windows Server<\/i> that provides a web login using existing Active Directory<\/i> credentials.<\/p>\nThis article explains how to configure a relying party for TopTeam<\/i> on ADFS Server.<\/font><\/p>\n<\/div><\/div>\n\nWho should read this?<\/h3>\n\n\n- TopTeam Administrators<\/li>\n
- TopTeam Users<\/li>\n<\/ul>\n<\/div><\/div>\n\n
Prerequisites<\/h3>\n\n\n- A server running Microsoft Server version <\/i>2008 or higher. <\/li>\n
- For configuring and installing ADFS, refer to the Microsoft KB article<\/a>.<\/li>\n
- When you have installed ADFS, note down the value for the ‘SAML 2.0\/W-Federation’ URL in the ADFS Endpoints <\/i>section. If you chose the defaults for the installation, this will be ‘\/adfs\/ls\/’.<\/li>\n<\/ul>\n<\/div><\/div>\n\n
Step 1. Start Add Relying Party Trust Wizard<\/h3>\n\nOpen the ADFS Management Console<\/i> and select Add Relying Party Trust <\/i>to start the Add Relying Party Trust Wizard.<\/i><\/p>\n<\/div><\/div>\n\n\n![\"media_1517378625591-1-1-1-1-1.png\"](\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\")
\n<\/div>\n<\/p><\/div>\n\n\n\n<\/div>\n<\/p><\/div>\n\nStep 2. Adding a Relying Party Trust<\/h3>\n\nThe connection between ADFS and TopTeam<\/i> is defined using a Relying Party Trust (RPT)<\/i>.<\/p>\n<\/div><\/div>\n\n\n\n<\/div>\n<\/p><\/div>\n\nStep 2.1. Select Data Source<\/h3>\n\n\n<\/div>\n<\/p><\/div>\n\nStep 2.2. Specify Display Name<\/h3>\n\n\n<\/div>\n<\/p><\/div>\n\nStep 2.3. Choose Profile<\/h3>\n\n\n<\/div>\n<\/p><\/div>\n\nStep 2.4. Configure Certificate (optional)<\/h3>\n\n\n<\/div>\n<\/p><\/div>\n\nStep 2.5. Specify TopTeam External Authentication Service URL<\/h3>\n\n\n<\/div>\n\nURL has the format: https:\/\/<Domain>\/rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS<\/strong>
\nIf your TopTeam<\/i> is running at https:\/\/acmecorp.com\/<\/strong>, the URL will be https:\/\/acmecorp.com\/rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS.<\/strong><\/p>\nNOTE<\/strong>:
\nURL is case-sensitive. We recommend you to copy-paste “rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS” part of the URL so as to avoid any connection errors.<\/p>\n<\/div><\/div>\n\nStep 2.6. Configure Identifiers<\/h3>\n\n\n<\/div>\n\nRelying party trust identifier has format: https:\/\/<Domain>\/rest\/ExternalAuth\/ttmExtAuthSrv.dll<\/strong>
\nE.g. https:\/\/acmecorp.com\/rest\/ExternalAuth\/ttmExtAuthSrv.dll<\/p>\n<\/div><\/div>\n\nStep 2.7. You can skip configuring Multi-factor Authentication<\/h3>\n\n\n<\/div>\n<\/p><\/div>\n\nStep 2.8. Choose Issuance Authorization Rules<\/h3>\n\n\n<\/div>\n\nOn the next two screens, the wizard will display an overview of your settings.<\/p>\n<\/div><\/div>\n
\nStep 2.9. Finish<\/h3>\n\n\n<\/div>\n<\/p><\/div>\n\nStep 3. Creating claim rules<\/h3>\n\nOnce the relying party has been created, you need to create the claim rules. Claim rules are required to pass on attributes of the authenticated user from ADFS to TopTeam<\/i>.<\/font><\/p>\n<\/div><\/div>\n\nStep 3.1. Add new rule<\/h3>\n\n\n<\/div>\n<\/p><\/div>\n\nStep 3.2. Choose Rule Type<\/h3>\n\n\n<\/div>\n<\/p><\/div>\n\nStep 3.3. Configure Claim Rule<\/h3>\n\n\n<\/div>\n\nSpecify LDAP Attribute<\/i> that should be submitted to TopTeam<\/i>. Ensure that the attribute value exactly matches with the Username<\/i> of TopTeam<\/i> user account otherwise login will be denied.<\/font><\/p>\n<\/div><\/div>\n\n\n\n<\/div>\n<\/p><\/div>\n\nStep 4. Adjusting the trust settings<\/h3>\n\nYou need to adjust settings on your RPT. To access these settings, select Properties<\/i> from the Actions<\/i> sidebar while you have the RPT selected.<\/p>\n<\/div><\/div>\n\nStep 4.1. Configure SAML Logout (optional)<\/h3>\n\n\n<\/div>\n<\/p><\/div>\n\n\n\n<\/div>\n\nTrusted URL<\/i> has format: https:\/\/<Domain>\/rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS\/Logout\/Request<\/strong>
\nE.g. https:\/\/acmecorp.com\/rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS\/Logout\/Request<\/p>\nResponse URL <\/i>has format: https:\/\/<Domain>\/rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS\/Logout\/Response<\/strong>
\nE.g. https:\/\/acmecorp.com\/rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS\/Logout\/Response<\/p>\nNOTE<\/strong>:
\nURLs are case-sensitive. We recommend you to copy-paste “rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS\/Logout\/Request” and “rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS\/Logout\/Response” part of the URLs so as to avoid any connection errors.<\/p>\n<\/div><\/div>\n\nYou have successfully configured Endpoint and RPT properties<\/h3>\n\n\n<\/div>\n<\/p><\/div>\n\nStep 5. Configure SAML in TopTeam<\/h3>\n\nFor more information, refer to the article Configuring External Authentication (SAML) in TopTeam<\/a>.<\/p>\n<\/div><\/div>\n
TopTeam<\/i> supports Web single sign-on (SSO) using Active Directory<\/i> with ADFS and SAML.<\/font> ADFS is a Microsoft <\/i>service for Windows Server<\/i> that provides a web login using existing Active Directory<\/i> credentials.<\/p>\n This article explains how to configure a relying party for TopTeam<\/i> on ADFS Server.<\/font><\/p>\n<\/div><\/div>\n Open the ADFS Management Console<\/i> and select Add Relying Party Trust <\/i>to start the Add Relying Party Trust Wizard.<\/i><\/p>\n<\/div><\/div>\n The connection between ADFS and TopTeam<\/i> is defined using a Relying Party Trust (RPT)<\/i>.<\/p>\n<\/div><\/div>\n URL has the format: https:\/\/<Domain>\/rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS<\/strong> NOTE<\/strong>: Relying party trust identifier has format: https:\/\/<Domain>\/rest\/ExternalAuth\/ttmExtAuthSrv.dll<\/strong> On the next two screens, the wizard will display an overview of your settings.<\/p>\n<\/div><\/div>\n Once the relying party has been created, you need to create the claim rules. Claim rules are required to pass on attributes of the authenticated user from ADFS to TopTeam<\/i>.<\/font><\/p>\n<\/div><\/div>\n Specify LDAP Attribute<\/i> that should be submitted to TopTeam<\/i>. Ensure that the attribute value exactly matches with the Username<\/i> of TopTeam<\/i> user account otherwise login will be denied.<\/font><\/p>\n<\/div><\/div>\n You need to adjust settings on your RPT. To access these settings, select Properties<\/i> from the Actions<\/i> sidebar while you have the RPT selected.<\/p>\n<\/div><\/div>\n Trusted URL<\/i> has format: https:\/\/<Domain>\/rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS\/Logout\/Request<\/strong> Response URL <\/i>has format: https:\/\/<Domain>\/rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS\/Logout\/Response<\/strong> NOTE<\/strong>: For more information, refer to the article Configuring External Authentication (SAML) in TopTeam<\/a>.<\/p>\n<\/div><\/div>\nWho should read this?<\/h3>\n
\n
Prerequisites<\/h3>\n
\n
Step 1. Start Add Relying Party Trust Wizard<\/h3>\n
\n<\/div>\n<\/p><\/div>\n
\n<\/div>\n<\/p><\/div>\n
Step 2. Adding a Relying Party Trust<\/h3>\n
\n<\/div>\n<\/p><\/div>\n
Step 2.1. Select Data Source<\/h3>\n
\n<\/div>\n<\/p><\/div>\n
Step 2.2. Specify Display Name<\/h3>\n
\n<\/div>\n<\/p><\/div>\n
Step 2.3. Choose Profile<\/h3>\n
\n<\/div>\n<\/p><\/div>\n
Step 2.4. Configure Certificate (optional)<\/h3>\n
\n<\/div>\n<\/p><\/div>\n
Step 2.5. Specify TopTeam External Authentication Service URL<\/h3>\n
\n<\/div>\n
\nIf your TopTeam<\/i> is running at https:\/\/acmecorp.com\/<\/strong>, the URL will be https:\/\/acmecorp.com\/rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS.<\/strong><\/p>\n
\nURL is case-sensitive. We recommend you to copy-paste “rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS” part of the URL so as to avoid any connection errors.<\/p>\n<\/div><\/div>\nStep 2.6. Configure Identifiers<\/h3>\n
\n<\/div>\n
\nE.g. https:\/\/acmecorp.com\/rest\/ExternalAuth\/ttmExtAuthSrv.dll<\/p>\n<\/div><\/div>\nStep 2.7. You can skip configuring Multi-factor Authentication<\/h3>\n
\n<\/div>\n<\/p><\/div>\n
Step 2.8. Choose Issuance Authorization Rules<\/h3>\n
\n<\/div>\n
Step 2.9. Finish<\/h3>\n
\n<\/div>\n<\/p><\/div>\n
Step 3. Creating claim rules<\/h3>\n
Step 3.1. Add new rule<\/h3>\n
\n<\/div>\n<\/p><\/div>\n
Step 3.2. Choose Rule Type<\/h3>\n
\n<\/div>\n<\/p><\/div>\n
Step 3.3. Configure Claim Rule<\/h3>\n
\n<\/div>\n
\n<\/div>\n<\/p><\/div>\n
Step 4. Adjusting the trust settings<\/h3>\n
Step 4.1. Configure SAML Logout (optional)<\/h3>\n
\n<\/div>\n<\/p><\/div>\n
\n<\/div>\n
\nE.g. https:\/\/acmecorp.com\/rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS\/Logout\/Request<\/p>\n
\nE.g. https:\/\/acmecorp.com\/rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS\/Logout\/Response<\/p>\n
\nURLs are case-sensitive. We recommend you to copy-paste “rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS\/Logout\/Request” and “rest\/ExternalAuth\/ttmExtAuthSrv.dll\/SAML\/ACS\/Logout\/Response” part of the URLs so as to avoid any connection errors.<\/p>\n<\/div><\/div>\nYou have successfully configured Endpoint and RPT properties<\/h3>\n
\n<\/div>\n<\/p><\/div>\n
Step 5. Configure SAML in TopTeam<\/h3>\n