Adding your Asset Bank as Relying Party

1. Log into the ADFS server and open the management console.
2. in the console tree, right-click the Relying Party Trusts folder, and then click Add Relying Party Trust to start the Add Relying Party Trust Wizard.
3. Enter your Asset Bank metadata URL which will be something like

   https://my.assetbank.domain/Shibboleth.sso/Metadata

   Where my.assetbank.domain is the URL of your Asset Bank:
   
4. Hit next and click OK to acknowledge the message about part of the metadata being skipped: this will not affect the integration with Asset Bank.
   
5. Enter your preferred display name for this relying party configuration.
   
6. On the multi-factor authentication step select "I do not want to configure multi-factor authentication [...]" and click next.
   
7. On the issuance authorization rules step select "Permit all users to access this relying party" and click next.
   
8. The configuration has been completed, you will be able to review the details before finalising the process.
9. Optional step: Configure Single Logout Support
   9.1 Go to ADFS manager > Trust Relationships > Relying Party Trusts > properties
   9.2 Under the Endpoints tab, click Add
   9.3 Configure the settings:
   Endpoint type: SAML Logout
   Binding: POST
   URL: https://myadfsserver.domain.net/adfs/ls/?wa=wsignout1.0
10. Select Endpoints and look under Metadata for the URL beside the Federation Metadata type. Copy the URL (or grab the metadata file if the URL is not publicly accessible) and send it to the Customer Service team.

Adding claims for your Asset Bank Relying Party

1. Right-click on the relying party trust and select Edit Claim Rules….
2. On the Issuance Transform Rules tab select Add Rules….
3. Select Send LDAP Attribute as Claims as the claim rule template to use.
4. Give the claim a name such as LDAP Attributes.
5. Set the Attribute Store to Active Directory and add the following mappings:

   LDAP Attribute	Outgoing Claim Type
   E-Mail Addresses	E-Mail Address
   Given-Name	Given Name
   Surname	Surname
   Token-Groups - Qualified by Domain Name	Group

   
   
6. Select Finish.
7. Select Add Rule….
8. Select Transform an Incoming Claim as the claim rule template to use.
9. Give it a name such as Name ID.
10. Choose the Incoming claim type based on what it is used in your organisation as unique user id, usually E-Mail Address or UPN.
    Choose Name ID as Outgoing claim type, and Unspecified as Outgoing name ID format.
    

General ADFS Setup

When using "Organization" or "Support contact information" for your federation service please make sure not to leave any empty field as this will produce a self-contained xml tag in the metadata file which will not validate in Asset Bank service provider (Shibboleth).

1. Right-click Service and choose Edit Federation Service Properties...

2. Under the "Organization" tab make sure that:

1. Organization details are filled in when "Publish organization information [...]" has been enabled
2. Contact information details are all filled in when at least one has been used