Below you can find a step by step tutorial on how to integrate Active Directory Federation Services IdP with MetaDefender Vault using the OpenID Connect protocol.

1. Open the Server Manager Desktop App and navigate to Tools → AD FS Management
   

2. Inside the AD FS Management app navigate to Application Groups → Add Application Group

3. Enter a descriptive name for the application group and select the Server application accessing a web API template
   

4. To find the Login redirect URI

   1. Go to MetaDefender Vault web console and navigate to Settings → Single Sign-On

   2. Turn on Enable Single Sign-On
      

   3. It might be necessary to turn on Ignore Certificate Issues if the AD FS server is using a self-signed certificate

   4. Turn off Load User Profile because AD FS 2016 and newer do not yet support calling the “/userinfo” endpoint

   5. Authority should point to your AD FS URL. You can compose the URL by appending “/adfs“ to the AD FS server’s fully qualified domain name (FQDN for short)

   6. IP Address or Domain should point to the location of your Vault instance. Once you fill this information, Vault will automatically generate the Redirect URI

   7. Copy the Redirect URI and go back to the AD FS Application Settings and paste it (step 5)

5. Add the copied URI to the list of known redirect endpoints and save the Client Identifier for later use
   

6. We will require a client secret, so select the Generate a shared secret action and copy the generated GUID for later use
   

7. Add the client identifier (generated at step 5) to the list of known clients
   

8. Choose which users will be allowed to authenticate.
   For the purpose of this tutorial we will be allowing everyone
   

9. Last but not least we must configure the allowed scopes.
   It is mandatory to select:

   1. openid → for enabling the OpenID Connect protocol

   2. profile → to receive the user’s name related claims (upn, display_name, first_name, last_name)

   3. email → to receive the user’s email claim (necessary for administrator role asignment)

   4. allatclaims → to allow the profile and email related claims to be contained in the identity token, since AD FS does not allow loading profile related claims from the userinfo endpoint
      

10. After the above setup is complete, the newly created application group should be displayed in the application groups list
    

11. There is just one more step to complete on the AD FS server side, attribute to claim mapping.
    Double click the newly created application group and edit the Web API
    

12. Navigate to the Issuance Transform Rules tab and click Add Rule…

13. Select the Send LDAP Attributes as Claims template and click Next
    

14. Select Active Directory as an Attribute store and create the following mappings.
    MetaDefender Vault recognizes the following claims:

    1. upn (required)

    2. email (required)

    3. name (optional)

    4. given_name (optional)

    5. family_name (optional)

    

15. Click Finish and Apply

16. On Vault’s side, input the Client ID (created at step 5) and Client Secret (created at step 6)
    

17. In case of misplacement, the Client ID and Client Secret can be fetched by accessing the application group’s affiliated server application
    

18. Add relevant Administrator Emails to select which users should be granted administrator rights
    and add the allatclaims scope to Integration Scopes
    

19. If everything is ready, click Update.

20. Log out of MetaDefender Vault

21. You will notice that there is a new LOGIN WITH SSO button on the login page
    

22. Click LOGIN WITH SSO. You should be redirected to Okta to login. Once logged in, you will be redirected back to MetaDefender Vault and automatically logged in.