Privacy Bee supports SAML 2.0 SSO for Active Directory Federation Services (AD FS). The following guide will show you the steps you need to follow in order to set up your AD FS as the Identity Provider for your Privacy Bee enterprise account.

You will have the option to maintain the ability to login via 2-factor email PIN or to only allow login through your AD FS from the Authentication settings page on the Privacy Bee app.

Step 1: Privacy Bee Setup

Step 1.1 – x509 Certificate

The first thing you will need to get is the x509 Certificate (base64 encoded) from your AD FS management window

• Select Services -> Certificates from the left sidebar and locate the Token signing certificate and right-click on it and click View Certificate.
  
  
• In the box that pops up click on the Details tab and select Copy to File. An export window will appear and you can click Next.
• Select Base-64 encoded X.509 (.CER) and click Next.
• Save that file, locate it, and open it in Notepad or another text editor. Copy the entire contents of the file.
• Navigate to the Authentication Settings page in the Privacy Bee portal and paste the certificate in the section that says x509 Certificate.
  
  

Step 1.2 – Login Endpoints

Now we will need to get the Entity and Sign-On URLs from your AD FS to finish the remaining endpoints.

• Entity ID
  • In the AD FS console, right-click Service and select Edit Federation Service Properties, copy the URL for Federation Service Identifier and enter that as the Entity ID in Privacy Bee.
    
    
• Login URL
  • In the left sidebar of AD FS open the Endpoints folder. Look for the SAML 2.0/WS-Federation link and copy the URL path. Using your domain and the URL path you can enter the Login URL on Privacy Bee.
• Finally toggle on the SSO Enabled button at the top of the page and click Update.
• Click the new “Download Metadata” button which appeared, and save that XML file. You’ll need it in the next step when setting up Privacy Bee as a Relying Trust Partner.

Now Privacy Bee has created your iDP link and in the footer notes will show a couple new URLs, needed for setting up AD FS in the next step.

Step 2: AD FS Setup

Step 2.1. – Add a Relying Party Trust (RPT)

• Open AD FS and select the Relying Party Trusts folder.
  
  
• On the right side click Add Relying Party Trust.
• In the dialog that pops up leave the default option of Claims Aware and click Start.
  
  
• On the Select Data Source screen you can either import the metadata file that is found on the Privacy Bee Authentication Settings page, or you can select Enter data about the relying party manually.
  • If you have opted to enter the data manually first in the Display Name field input a unique name such as “Privacy Bee SSO” and click Next.
    
    
  • You can leave the settings default on the Configure Certificate page and click Next.
  • On the Configure URL screen select the option Enable support for the SAML 2.0 WebSSO protocol. And enter the ACS URL found on the Privacy Bee Authentication page and click Next.
    
    
  • On the Configure Identifiers screen enter the Entity ID from the Privacy Bee Authentication page in the “Relying party trust identifier” field:
    
    
    … then click “Add”
    
    
    … and “Next >”
• In the Choose an access control policy screen, you can select Permit Everyone or whatever controls you wish to place on access and click Next.
• You can review the settings on the final page and click Next and then Close.

Step 2.2 – Create Claims Rules

In order to properly allow login for Privacy Bee it is necessary that the Name Identifier used with this integration is set to email address.

• In the Claims Rule window you can select Add Rule.
• Select Claim rule template in the menu and select Send LDAP Attributes as Claims and click Next.
  • Give a name to the Claim Rule.
  • In Attribute Store select Active Directory and in the mappings map the LDAP Attribute E-mail-Addresses to E-Mail Address.
  • Click Finish to add this rule.
    
    
    
• Add another claim rule and this time select the template Transform an Incoming Claim and click Next.
  • Give a name to the Claim Rule.
  • For Incoming Claim Type select E-Mail Address.
  • For Outgoing Claim Type select Name ID.
  • For Outgoing name ID format select Email.
  • Click Finish to add this rule.
• Click OK to create both rules.

Step 2.3 – Trust Settings

In the Relying Party Trusts folder you will then want to select Properties from the sidebar and on the Advanced tab make sure that SHA-256 is the chosen hash algorithm.

Step 3- Testing SSO Login

That’s it! Now let’s test it out.

We recommend that you do not turn off the Enable PIN Login until you have tested your AD FS login and everything is working correctly. Once you have successfully logged in via AD FS you can disable the ability to login via PIN and all employees will be forced through AD FS.

Please contact Privacy Bee immediately if you have any issues setting this up or have turned off PIN login before verifying your AD FS connection.