# <font face="Arial, sans-serif">Integrating SimpleSAMLphp with ADFS 2012R2</font>

# <font face="Arial, sans-serif">Pre-requisites</font>

*   **<font face="Arial, sans-serif">A working ADFS 2012R2 implementation.</font>**_<font face="Arial, sans-serif">Apologies but this isn’t something I’ve blogged about yet (I will, soon). For now, there are plenty of fantastic articles on setting up ADFS out there but when you do it, make sure you’re setting up ADFS 2012R2 (It’s on Windows Server 2012R2 of course). Why am I telling you to set it up on Windows Server 2012R2? Simple, [Alternate Login ID](https://technet.microsoft.com/en-us/library/dn659436.aspx).</font>_

*   **<font face="Arial, sans-serif">Access to a Linux box with an updated version of OpenSSL.</font>**_<font face="Arial, sans-serif">OK, so strictly you don’t need a Linux box – it’s just easier if you have access to one. We need to generate a certificate and key for token signing purposes and fiddling with installations of OpenSSL on Windows isn’t something I want to document. Spin one up in Azure and bin it once you’re done with it!</font>_

# <a name="more-1534"></a><font face="Arial, sans-serif">Configure SimpleSAMLphp to use ADFS 2012R2 as an IdP</font>

<font face="Arial, sans-serif">The first thing to do is configure SimpleSAMLphp with our ADFS server’s federation metadata. To do this, we must download the <font style="font-size: 10pt" size="2">FederationMetadata.xml</font> file from our ADFS server and use SimpleSAMLphp to convert it in to a format that it can understand.</font>

1.  <font face="Arial, sans-serif">Firstly, I know my Federation Service is located at [https://fs.transishun.co.uk/](https://fs.transishun.co.uk/) but where’s the</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">FederationMetadata.xml</font></font> <font face="Arial, sans-serif">file? To get the location of the</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">FederationMetadata.xml</font></font> <font face="Arial, sans-serif">file: on your ADFS server open the ADFS Management console, expand</font> **<font face="Arial, sans-serif">Service</font>** <font face="Arial, sans-serif">and select the</font> **<font face="Arial, sans-serif">Endpoints</font>** <font face="Arial, sans-serif">node. The Metadata section shows us that the</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">FederationMetadata.xml</font></font> <font face="Arial, sans-serif">file is located at</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">/FederationMetadata/2007-06/FederationMetadata.xml</font></font><font face="Arial, sans-serif">.  
    This is actually the same location for all ADFS services but I wanted to show you where it was from.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_c35581beca8bddb2.png)</font> 

2.  <font face="Arial, sans-serif">Open a browser and navigate to the <font style="font-size: 10pt" size="2">FederationMetadata.xml</font> location: <font style="font-size: 10pt" size="2">https://fs.transishun.co.uk/FederationMetadata/2007-06/FederationMetadata.xml</font> where you’ll be prompted to save the file to disk.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_b5db2c6bd0591d99.png)</font> 

3.  <font face="Arial, sans-serif">Open the file and copy its contents to the clipboard.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_a1ff1cfcf3006c5e.png)</font> 

4.  <font face="Arial, sans-serif">Browse to our web application’s installation of SimpleSAMLphp. Navigate to the Federation tab and click</font> **<font face="Arial, sans-serif">XML to simpleSAMLphp metadata converter  
    </font>****_<font face="Arial, sans-serif">NB: If you have no clue what I’m talking about, it would be a good idea to read through the two posts preceding this one where I explain how to install and configure SimpleSAMLphp</font>_**<font face="Arial, sans-serif">![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_7ef91e7de49dfb0d.png)</font> 

5.  <font face="Arial, sans-serif">Paste the contents of the</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">FederationMetadata.xml</font></font> <font face="Arial, sans-serif">file in to the</font> **<font face="Arial, sans-serif">XML metadata</font>** <font face="Arial, sans-serif">field and click the</font> **<font face="Arial, sans-serif">Parse</font>** <font face="Arial, sans-serif">button.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_26d4fc661700370b.png)</font> 

6.  <font face="Arial, sans-serif">The page will return two sets of data. For our purposes, the first:</font> **<font face="Arial, sans-serif">saml20-sp-remote</font>** <font face="Arial, sans-serif">can be ignored since we are not using SimpleSAMLphp as an identity provider, that’s ADFS’ job. Scroll to</font> **<font face="Arial, sans-serif">saml20-idp-remote</font>** <font face="Arial, sans-serif">and copy the contents of this field to the clipboard.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_600f1b7a5ad52cf4.png)</font> 

7.  <font face="Arial, sans-serif">Browse to the installation of SimpleSAMLphp on the IIS server and open the</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">metadata</font></font> <font face="Arial, sans-serif">folder.</font>**_<font face="Arial, sans-serif">NB: Don’t know what I’m talking about or where this is? Please read the two posts preceding this one!</font>_**<font face="Arial, sans-serif">![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_464940023b5cc0b4.png)</font> 

8.  <font face="Arial, sans-serif">Open the</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">saml20-idp-remote.php</font></font> <font face="Arial, sans-serif">file in your favourite text editor.</font>_<font face="Arial, sans-serif">Note: Did you notice the pattern? We copied the data from the</font> __**<font face="Arial, sans-serif">saml20-idp-remote</font>**__ <font face="Arial, sans-serif">field of the converted metadata page and that is now going to be copied in to the PHP file of the same name.</font>_<font face="Arial, sans-serif">![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_6ce5dd32675a484.png)</font> 

9.  <font face="Arial, sans-serif">Paste the converted metadata at the bottom of the file then save it.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_9bca4f9ad3bcc559.png)</font> 

# <font face="Arial, sans-serif">Create a service provider configuration in SimpleSAMLphp</font>

1.  <font face="Arial, sans-serif">Navigate to your SimpleSAMLphp installation folder on the IIS server and open the config folder.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_bc29ae2157b093ad.png)</font> 

2.  <font face="Arial, sans-serif">Open <font style="font-size: 10pt" size="2">authsources.php</font> in your favourite text editor.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_1f3abe463a5168e3.png)</font> 

3.  <font face="Arial, sans-serif">I’m not going to repeat much of what I wrote in the post preceding this one where I added a Service Provider for Azure AD. Here, we will create a service provider configuration that uses our ADFS server. There are some differences in the configuration between Azure AD and ADFS 2012R2. The name of your SP is your choice, mine is called <font style="font-size: 10pt" size="2">transishun-sp</font>.</font>

<font face="Arial, sans-serif">**SOURCE CODE**</font>

<font face="Arial, sans-serif">============================================================</font>

<font face="Arial, sans-serif">============================================================</font>

<font face="Arial, sans-serif"><font color="#0000ff">// An authentication source which can authenticate against both SAML 2.0</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// and Shibboleth 1.3 IdPs. If you make any configuration changes, you will need</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// to update the RPT at the IdP.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'transishun-sp' => array(</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'saml:SP',</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// The entity ID of this SP.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// Can be NULL/unset, in which case an entity ID is generated based on the metadata URL.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'entityID' => null,</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// The entity ID of the IdP this should SP should contact.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// Can be NULL/unset, in which case the user will be shown a list of available IdPs.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'idp' => 'http://fs.transishun.co.uk/adfs/services/trust',</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// The URL to the discovery service.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// Can be NULL/unset, in which case a builtin discovery service will be used.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'discoURL' => null,</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// ADFS 2012R2 requires signing of the logout - the others are optional (may be overhead you don't want.)</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'sign.logout' => TRUE,</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'redirect.sign' => TRUE,</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'assertion.encryption' => TRUE,</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// We now need a certificate and key. The following command (executed on Linux usually)</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// creates a self-signed cert and key, using SHA256, valid for 2 years.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// openssl req -x509 -nodes -sha256 -days 730 -newkey rsa:2048 -keyout my.key -out my.pem</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'privatekey' => 'my.key',</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'certificate' => 'my.pem',</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// Enforce the use of SHA-256 by default.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'signature.algorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">),</font></font>

<font face="Arial, sans-serif">===================================================================</font>

<font face="Arial, sans-serif">===================================================================</font>

<font face="Arial, sans-serif">4\. Here is how the code looks inside my authsources.php file.  
![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_2c0e0def3940b89f.png)</font> 

2.  <font face="Arial, sans-serif">You will notice that the SP code defines that we must <font style="font-size: 10pt" size="2">sign.logout</font>, <font style="font-size: 10pt" size="2">redirect.sign</font> and <font style="font-size: 10pt" size="2">assertion.encryption</font>. All of these declarations mean we need a certificate and key to sign and encrypt these communications. We’ll create the certificate and key in the next section.</font>

3.  <font face="Arial, sans-serif">The final declaration enforces the use of SHA-256 which is best practice.</font>

# <font face="Arial, sans-serif">Creating a certificate and key file for signing and encryption</font>

<font face="Arial, sans-serif">I mentioned in the requirements that you would need a Linux machine. Again, if you need one, just spin one up on Azure, I did.</font>

![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_25cc946b8ec1e5da.png)

1.  <font face="Arial, sans-serif">Log on to your Linux machine. Use Putty to log on via SSH.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_80081f6d78a1c40a.png)</font> 

2.  <font face="Arial, sans-serif">Create a directory called cert and change in to it.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_305e52eeeabe70fe.png)</font> 

3.  <font face="Arial, sans-serif">If you recall from the SP definition code at the end of previous section, I provided an example command for generating a two year certificate and key:  
    </font><font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">openssl req -x509 -nodes -sha256 -days 730 -newkey rsa:2048 -keyout my.key -out my.pem  
    </font></font>_<font face="Arial, sans-serif">I extrapolated this from [the documentation on the SimpleSAMLphp website](https://simplesamlphp.org/docs/1.13/simplesamlphp-sp) in section 1.1\. If you’re using this in a production environment, generate a key and cert that will last. The SimpleSAMLphp documentation suggests 10 years.</font>_

4.  <font face="Arial, sans-serif">Run the command to create the key and certificate. You will be asked a number of questions, answer these however you like, this cert and key is only used for signing and encrypting on the SP. My run through is shown below.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_440e7d63336464d6.png)</font> 

5.  <font face="Arial, sans-serif">Now you need to download the</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">my.key</font></font> <font face="Arial, sans-serif">and</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">my.pem</font></font> <font face="Arial, sans-serif">files. There’s a number of ways but since they’re just text, I usually just</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">cat</font></font> <font face="Arial, sans-serif">them to screen and copy/paste from the Putty console in to a file on my local machine.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_d2955f66a71f804e.png)</font>**_<font face="Arial, sans-serif">NB: Don’t get too excited, this is an example key, I don’t use this one myself.</font>_**

6.  <font face="Arial, sans-serif">Navigate to the SimpleSAMLphp installation folder and create a folder called <font style="font-size: 10pt" size="2">cert</font>.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_a1865969e0eeb8c4.png)</font> 

7.  <font face="Arial, sans-serif">Copy the</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">my.key</font></font> <font face="Arial, sans-serif">and</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">my.pem</font></font> <font face="Arial, sans-serif">files in to the</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">cert</font></font> <font face="Arial, sans-serif">folder. These are the two files that we declared when we created the Service Provider configuration in</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">authsources.php</font></font><font face="Arial, sans-serif">. The</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">cert</font></font> <font face="Arial, sans-serif">folder is the default location for certs and keys in SimpleSAMLphp as mentioned in [the documentation](https://simplesamlphp.org/docs/1.13/simplesamlphp-sp).  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_23488ae1952b763f.png)</font> 

# <font face="Arial, sans-serif">Create the Relying Party Trust in ADFS 2012R2</font>

<font face="Arial, sans-serif">Now that the Service Provider configuration is complete, SimpleSAMLphp creates the SAML 2.0 SP metadata that we can use to import in to ADFS.</font>

1.  <a name="crayon-5f7fe0cd8ab70580383406"></a><a name="crayon-5f7fe0cd8ab72428592771"></a><font face="Arial, sans-serif">Navigate to the web application’s</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">/simplesaml</font></font> <font face="Arial, sans-serif">application and click the</font> **<font face="Arial, sans-serif">Federation</font>** <font face="Arial, sans-serif">tab. As you can see, our previous</font> **<font face="Arial, sans-serif">default-sp</font>** <font face="Arial, sans-serif">configuration (the one we configured for use with Azure AD) is here, but now so is the one I’ve called</font> **<font face="Arial, sans-serif">transishun-sp</font>**<font face="Arial, sans-serif">. If you’re wondering where the heck that URL came from, it’s because we left the</font> <font face="Arial, sans-serif"><font style="font-size: 9pt" size="2">entityID</font></font><font face="Arial, sans-serif">value</font> <font face="Arial, sans-serif"><font style="font-size: 9pt" size="2">null</font></font><font face="Arial, sans-serif">  when we specified the SP configuration.</font>

<font face="Arial, sans-serif">**SOURCECODE**</font>

<font face="Arial, sans-serif">==========================================================================</font>

<font face="Arial, sans-serif">==========================================================================</font>

<font color="#0000ff"><font face="Arial, sans-serif">// The entity ID of this SP.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// Can be NULL/unset, in which case an entity ID is generated based on the metadata URL.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'entityID' => nu</font><font face="Arial, sans-serif">ll</font></font>

<font face="Arial, sans-serif">==========================================================================</font>

<font face="Arial, sans-serif">==========================================================================</font><font face="Arial, sans-serif">![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_a9bf9a5fdced9c8d.png)</font> 

8.  <font face="Arial, sans-serif">If you wish, click the</font> **<font face="Arial, sans-serif">Show metadata</font>** <font face="Arial, sans-serif">link to see the metadata but before you do, copy the</font> **<font face="Arial, sans-serif">Entity ID</font>**<font face="Arial, sans-serif">: url. We need to give this to ADFS when we configure the Relying Party Trust.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_3452de7841af7582.png)</font> 

9.  <font face="Arial, sans-serif">On your ADFS server, open the ADFS Management console, expand</font> **<font face="Arial, sans-serif">Trust Relationships</font>** <font face="Arial, sans-serif">and select the</font> **<font face="Arial, sans-serif">Relying Party Trusts</font>** <font face="Arial, sans-serif">node. In the</font> **<font face="Arial, sans-serif">Actions</font>** <font face="Arial, sans-serif">pane, click</font> **<font face="Arial, sans-serif">Add Relying Party Trust…</font>**<font face="Arial, sans-serif">![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_ce1793275b448320.png)</font> 

10.  <font face="Arial, sans-serif">Click</font> **<font face="Arial, sans-serif">Start</font>** <font face="Arial, sans-serif">then paste the</font> **<font face="Arial, sans-serif">Entity ID</font>** <font face="Arial, sans-serif">url in to the</font> **<font face="Arial, sans-serif">Federation Metadata</font>** <font face="Arial, sans-serif">address field and click</font> **<font face="Arial, sans-serif">Next</font>**<font face="Arial, sans-serif">.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_fe9d5a39a4e0b01b.png)</font> 

11.  <font face="Arial, sans-serif">Accept the warning.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_babd062bbad4e4b6.png)</font> 

12.  <font face="Arial, sans-serif">Next your way through the wizard until you reach the</font> **<font face="Arial, sans-serif">Ready To Add</font>** <font face="Arial, sans-serif">Trust page. Here you’ll want to review the numerous tabs – check the</font> **<font face="Arial, sans-serif">Encryption</font>** <font face="Arial, sans-serif">and</font> **<font face="Arial, sans-serif">Signature</font>** <font face="Arial, sans-serif">tabs have certificates associated with them. Even if they don’t and you’ve not completed the previous section to create the certificates, the RPT can be updated whenever you like.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_7d2f70e2ff401848.png)</font> 

13.  <font face="Arial, sans-serif">Click</font> **<font face="Arial, sans-serif">Next</font>** <font face="Arial, sans-serif">and the</font> **<font face="Arial, sans-serif">sso.lewisroberts.com</font>** <font face="Arial, sans-serif">Relying Party Trust is added.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_3e28c38279b4d20e.png)</font> 

14.  <font face="Arial, sans-serif">Select the</font> **<font face="Arial, sans-serif">Relying Party Trust</font>** <font face="Arial, sans-serif">we’ve just added and then click</font> **<font face="Arial, sans-serif">Edit Claim Rules…</font>**<font face="Arial, sans-serif">![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_3f42c63af01adc16.png)</font> 

15.  <font face="Arial, sans-serif">Add an</font> **<font face="Arial, sans-serif">Issuance Transform Rule</font>** <font face="Arial, sans-serif">based on the</font> **<font face="Arial, sans-serif">Send LDAP Attributes as Claims</font>** <font face="Arial, sans-serif">template. Select at least</font> **<font face="Arial, sans-serif">UPN</font>**<font face="Arial, sans-serif">, whatever else you choose here is your choice but add another such as</font> **<font face="Arial, sans-serif">mail</font>** <font face="Arial, sans-serif">or</font> **<font face="Arial, sans-serif">uid</font>**<font face="Arial, sans-serif">.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_2e280b78dac84561.png)</font> 

16.  <font face="Arial, sans-serif">Add another Issuance Transform Rule but this time based on the</font> **<font face="Arial, sans-serif">Transform an Incoming Claim</font>** <font face="Arial, sans-serif">template. This one is important and is required to allow SimpleSAMLphp to talk with ADFS.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_bb5b5f2c5dde2437.png)</font> 

17.  <font face="Arial, sans-serif">Once configured, you should have two Issuance Transform Rules that look as follows:  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_6cf89600127daca9.png)</font> 

# <font face="Arial, sans-serif">Testing Authentication</font>

<font face="Arial, sans-serif">Now that we have configured SimpleSAMLphp as the service provider, ADFS as the IdP, exchanged metadata between the two and configured some basic claims rules. We are now able to test authentication.</font>

1.  <font face="Arial, sans-serif">Navigate to the simplesaml web application for our site https://sso.lewisroberts.com/simplesaml then select the</font> **<font face="Arial, sans-serif">Authentication</font>** <font face="Arial, sans-serif">tab and click</font> **<font face="Arial, sans-serif">Test configured authentication sources</font>**<font face="Arial, sans-serif">.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_6e2db503c7a40819.png)</font> 

2.  <font face="Arial, sans-serif">Select</font> **<font face="Arial, sans-serif">transishun-sp</font>** <font face="Arial, sans-serif">from the list.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_affe8a2d39ad27ee.png)</font> 

3.  <font face="Arial, sans-serif">You will be immediately sent off to the ADFS server (or Web Application Proxy depending on how your ADFS farm is configured). Enter your user ID in the format “domain\user” or “user@domain”.  
    </font>**<font face="Arial, sans-serif">NB</font>**<font face="Arial, sans-serif">: Now, I’ve cheated slightly, I have [enabled Alternate Login ID](https://technet.microsoft.com/en-us/library/dn659436.aspx) so I can sign in with my email address. If you see the article I’ve linked to, Microsoft</font> **<font face="Arial, sans-serif">strongly</font>** <font face="Arial, sans-serif">recommend using the mail attribute for sign in. As they say;</font>_<font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">One of the benefits of this feature is that it enables you to adopt SaaS providers, such as Office 365 with AAD without modifying your on-premise UPNs. It also enables you to support line-of-business service applications with consumer-provisioned identities.</font></font>_<font face="Arial, sans-serif">![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_379b9e352c6417fc.png)</font> 

4.  <font face="Arial, sans-serif">Once signed in, you’ll be bounced back to SimpleSAMLphp and shown your claims. If it all went a bit wobbly, double-check everything and then check the Event Viewer for hints as to what could have gone wrong.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_18c29eb37d04a3eb.png)</font> 

5.  <font face="Arial, sans-serif">Click</font> **<font face="Arial, sans-serif">Logout</font>** <font face="Arial, sans-serif">to test this works as expected – this is where the</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">sign.logout</font></font> <font face="Arial, sans-serif">declaration in the Service Provider configuration becomes relevant. ADFS</font> _<font face="Arial, sans-serif">requires</font>_ <font face="Arial, sans-serif">the logout to be signed.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_e6acf27a085c5342.png)  
    That looks as though it’s working.</font>

6.  <font face="Arial, sans-serif">Let’s add another claim using the</font> **<font face="Arial, sans-serif">Send Group Membership as a Claim</font>** <font face="Arial, sans-serif">template just to get a little more understanding of what’s happening.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_a85ed89bcf4cd6f1.png)</font> 

7.  <font face="Arial, sans-serif">After re-authenticating, we can see the group claim is sent through as well.  
    ![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_f44f78dbb737e298.png)</font> 

# <font face="Arial, sans-serif">What about our custom PHP application?</font>

<font face="Arial, sans-serif">Good job you asked, I nearly forgot.</font>

<font face="Arial, sans-serif">In the previous blog post, I provided some code that I took from the SimpleSAMLphp website. On line 3 of that code when we created a new object, we specified the service provider we wanted to use. It looked like this:</font>

<font face="Arial, sans-serif">**SOURCE CODE**</font>

<font face="Arial, sans-serif">===================================================</font>

<font face="Arial, sans-serif">===================================================</font>

<font color="#0000ff"><font face="Arial, sans-serif">$as = new SimpleSAML_Auth_Simple('default-sp');</font></font>

<font face="Arial, sans-serif">===================================================</font>

<font face="Arial, sans-serif">===================================================</font>

<font face="Arial, sans-serif">Not to be too cheeky but basically, we would simply change the service provider to, you guessed it, <font style="font-size: 10pt" size="2">transishun-sp</font>. After doing so, the whole file looks like this:</font>

<font face="Arial, sans-serif">SOURCE CODE</font>

<font face="Arial, sans-serif">===================================================</font>

<font face="Arial, sans-serif">===================================================</font>

<font color="#0000ff"><font face="Arial, sans-serif"><?php</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">require_once (dirname(__FILE__) . '/../simplesamlphp/lib/_autoload.php');</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">$as = new SimpleSAML_Auth_Simple('transishun-sp');</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">$as->requireAuth();</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">$attributes = $as->getAttributes();</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">?></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"><!DOCTYPE html></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"><html></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"><head></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"><title>Index Page</title></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"></head></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"><body></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"><h2>Index Page</h2></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"><h3>Welcome <strong>Authenticated User</strong>!</h3></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"><h4>Claim list:</h4></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"><?php</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">echo '<pre>';</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">print_r($attributes);</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">echo '</pre>';</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">echo '<a href="/logout.php">Logout</a>';</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">?></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"></body></font></font>

<font color="#0000ff"><font face="Arial, sans-serif"></html></font></font>

<font face="Arial, sans-serif">===================================================</font>

<font face="Arial, sans-serif">===================================================</font>

<font face="Arial, sans-serif">After changing that, you can test your application and instead of being sent off to Azure AD for authentication, you’ll be sent to the federation service where, after logging on and being sent back to your application, you’ll see something like this – obviously changing depending on the claims you configured.</font>

![](Integrating%20SimpleSAMLphp%20with%20ADFS%202012R2%20-%20lewisroberts.com_html_1b738670b2365747.png)

<font face="Arial, sans-serif">Hang on, I noticed in the</font> **<font face="Arial, sans-serif">index.php</font>** <font face="Arial, sans-serif">file that the</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">logout</font></font> <font face="Arial, sans-serif">link is different than the preceding post’s example. You’re right, it is – why? Well, if you left that Logout link in place, you will indeed be logged out but then you’ll be sent straight back to the application which will need you to log back in again and you’ll be sent off to sign in – not a great user experience.</font>

<a name="crayon-5f7fe0cd8ab7a096290175"></a><font face="Arial, sans-serif">To overcome this, we can send our user to a different page. It</font> _<font face="Arial, sans-serif">can</font>_ <font face="Arial, sans-serif">be done using the</font> <font face="Arial, sans-serif"><font style="font-size: 9pt" size="2">getLogoutURL()</font></font><font face="Arial, sans-serif">function but if we wish to be certain the user was logged out, as per [the SimpleSAMLphp documentation section 5.3](https://simplesamlphp.org/docs/1.13/simplesamlphp-sp-api), I would create two files:</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">logout.php</font></font> <font face="Arial, sans-serif">and</font> <font face="Arial, sans-serif"><font style="font-size: 10pt" size="2">logged_out.php</font></font> <font face="Arial, sans-serif">with the following contents. What each file does should be pretty clear.</font>

## <font face="Arial, sans-serif">logout.php</font>

<font face="Arial, sans-serif">SOURCE CODE</font>

<font face="Arial, sans-serif">=======================================================================</font>

<font face="Arial, sans-serif">=======================================================================</font>

<font color="#0000ff"><font face="Arial, sans-serif"><?php</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">require_once (dirname(__FILE__) . '/../simplesamlphp/lib/_autoload.php');</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">$as = new SimpleSAML_Auth_Simple('transishun-sp');</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">$as->logout(array(</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'ReturnTo' => 'https://sso.lewisroberts.com/logged_out.php',</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'ReturnStateParam' => 'LogoutState',</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">'ReturnStateStage' => 'MyLogoutState',</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">));</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">?></font></font>

<font face="Arial, sans-serif">=======================================================================</font>

<font face="Arial, sans-serif">=======================================================================</font>

## <font face="Arial, sans-serif">logged_out.php</font>

<font face="Arial, sans-serif">SOURCE CODE</font>

<font face="Arial, sans-serif">=======================================================================</font>

<font face="Arial, sans-serif">=======================================================================</font>

<font color="#0000ff"><font face="Arial, sans-serif"><?php</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">require_once (dirname(__FILE__) . '/../simplesamlphp/lib/_autoload.php');</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">try {</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">if ($_REQUEST['LogoutState']) {</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">$state = SimpleSAML_Auth_State::loadState((string)$_REQUEST['LogoutState'], 'MyLogoutState');</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">}</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">else {</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">echo "Were you logged in?";</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">exit;</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">}</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">}</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">catch (Exception $e) {</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">echo 'Caught exception: ', $e->getMessage(), "\n";</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">exit;</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">}</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">$ls = $state['saml:sp:LogoutStatus']; // Only works for SAML SP</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">if ($ls['Code'] === 'urn:oasis:names:tc:SAML:2.0:status:Success' && !isset($ls['SubCode'])) {</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// Successful logout.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">echo("You have been logged out.");</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">} else {</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">// Logout failed. Tell the user to close the browser.</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">echo("We were unable to log you out of all your sessions. To be completely sure that you are logged out, you need to close your web browser.");</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">}</font></font>

<font color="#0000ff"><font face="Arial, sans-serif">?></font></font>

<font face="Arial, sans-serif">=======================================================================</font>

<font face="Arial, sans-serif">=======================================================================</font>

<font face="Arial, sans-serif">Well, that about wraps it up for another large post but hopefully there’s some useful information in there for you. If you’ve found the article helpful, you can say a quick thanks by clicking an advert. Don’t forget to read the two posts preceding this one to discover why I went down this rabbit hole and decided to take you all with me.</font>

<font face="Arial, sans-serif">-Lewis</font>