Integrating SimpleSAMLphp with ADFS 2012R2
=========================================


Pre-requisites
------------------

**A working ADFS 2012R2 implementation.**
Apologies but this isn’t something I’ve blogged about yet (I will, soon). For now, there are plenty of fantastic articles on setting up ADFS out there but when you do it, make sure you’re setting up ADFS 2012R2 (It’s on Windows Server 2012R2 of course). Why am I telling you to set it up on Windows Server 2012R2? Simple, Alternate Login ID.

**Access to a Linux box with an updated version of OpenSSL.**
OK, so strictly you don’t need a Linux box – it’s just easier if you have access to one. We need to generate a certificate and key for token signing purposes and fiddling with installations of OpenSSL on Windows isn’t something I want to document. Spin one up in Azure and bin it once you’re done with it!

Configure SimpleSAMLphp to use ADFS 2012R2 as an IdP
------------------------------------------------------

The first thing to do is configure SimpleSAMLphp with our ADFS server’s federation metadata. To do this, we must download the FederationMetadata.xml file from our ADFS server and use SimpleSAMLphp to convert it in to a format that it can understand.

1. Firstly, I know my Federation Service is located at https://fs.transishun.co.uk/ but where’s the FederationMetadata.xml file? To get the location of the FederationMetadata.xml file: on your ADFS server open the ADFS Management console, expand Service and select the Endpoints node. The Metadata section shows us that the FederationMetadata.xml file is located at /FederationMetadata/2007-06/FederationMetadata.xml.
This is actually the same location for all ADFS services but I wanted to show you where it was from.

![Image1](/Integrating_SimpleSAMLphp_with_ADFS_2012R2/Integrating SimpleSAMLphp with ADFS 2012R2 - lewisroberts.com_html_c35581beca8bddb2.png)

2. Open a browser and navigate to the FederationMetadata.xml location: https://fs.transishun.co.uk/FederationMetadata/2007-06/FederationMetadata.xml where you’ll be prompted to save the file to disk.

![Image2](/Integrating_SimpleSAMLphp_with_ADFS_2012R2/Integrating SimpleSAMLphp with ADFS 2012R2 - lewisroberts.com_html_b5db2c6bd0591d99.png)

3. Open the file and copy its contents to the clipboard.

![Image3](/Integrating_SimpleSAMLphp_with_ADFS_2012R2/Integrating SimpleSAMLphp with ADFS 2012R2 - lewisroberts.com_html_a1ff1cfcf3006c5e.png)

4. Browse to our web application’s installation of SimpleSAMLphp. Navigate to the Federation tab and click XML to simpleSAMLphp metadata converter
NB: If you have no clue what I’m talking about, it would be a good idea to read through the two posts preceding this one where I explain how to install and configure SimpleSAMLphp

![Image4](/Integrating_SimpleSAMLphp_with_ADFS_2012R2/Integrating SimpleSAMLphp with ADFS 2012R2 - lewisroberts.com_html_7ef91e7de49dfb0d.png)

5. Paste the contents of the FederationMetadata.xml file in to the XML metadata field and click the Parse button.
![Image4](/Integrating_SimpleSAMLphp_with_ADFS_2012R2/Integrating SimpleSAMLphp with ADFS 2012R2 - lewisroberts.com_html_26d4fc661700370b.png)

6. The page will return two sets of data. For our purposes, the first: saml20-sp-remote can be ignored since we are not using SimpleSAMLphp as an identity provider, that’s ADFS’ job. Scroll to saml20-idp-remote and copy the contents of this field to the clipboard.
![Image4](/Integrating_SimpleSAMLphp_with_ADFS_2012R2/Integrating SimpleSAMLphp with ADFS 2012R2 - lewisroberts.com_html_600f1b7a5ad52cf4.png)

7. Browse to the installation of SimpleSAMLphp on the IIS server and open the metadata folder.
NB: Don’t know what I’m talking about or where this is? Please read the two posts preceding this one!
![Image4](/Integrating_SimpleSAMLphp_with_ADFS_2012R2/Integrating SimpleSAMLphp with ADFS 2012R2 - lewisroberts.com_html_464940023b5cc0b4.png)

8. Open the saml20-idp-remote.php file in your favourite text editor.
Note: Did you notice the pattern? We copied the data from the saml20-idp-remote field of the converted metadata page and that is now going to be copied in to the PHP file of the same name.
![Image4](/Integrating_SimpleSAMLphp_with_ADFS_2012R2/Integrating SimpleSAMLphp with ADFS 2012R2 - lewisroberts.com_html_6ce5dd32675a484.png)

Paste the converted metadata at the bottom of the file then save it.
![Image4](/Integrating_SimpleSAMLphp_with_ADFS_2012R2/Integrating SimpleSAMLphp with ADFS 2012R2 - lewisroberts.com_html_9bca4f9ad3bcc559.png)
