Read the information below and, next, perform the steps.

Attention:

This is a generic description of the structure of this part, AFAS does not provide any support for this. This description is intended for system administrators who have sufficient knowledge of the design of this component. Due to changes at external parties, it is possible that certain parts has been changed without our knowledge.

Additional AD FS system requirements:

You must have Active Directory Federation Services 4.0 in Windows Server 2016.

Active Directory Federation Services 4.0 is available as a role. You must, however, activate this role. Refer to the relevant Microsoft documentation for more information.

What do you need on AFAS Online?

You must make a note of the following data during the configuration process. You will need this data later on to link AFAS Online to your AD FS.

• The URL of the AD FS that you configured (for the OpenID Connect configuration url field when linking the portal.
• Client identifier, for the Client id field in the portal
• Secret, for the Client secret field in the portal

Step 1: Configure the identity provider:

1. Start the server with Windows Server 2016 on which you want to configure AD FS.
2. Start Server Manager.
3. Go to Tools/AD FS Management.

   

4. Select AD FS / Application Groups.
5. Click on Add Application Group (to the right).

   

6. Enter a name for the new application group.
7. Select Server application at Template.
8. Click Next.

   

9. Enter a name.

   There's a unique code at the Client Identifier.

10. Note this Client identifier. You will need this for the self service (Client ID ).
11. Enter https://sts.afasonline.com/signin-oidc at Redirect Uri and click on Add.
12. Click Next.

    

13. Enable Generate a shared secret.
14. Note the value at Secret.
15. Complete the wizard.
16. Open the properties of the application group you've just added.

    

17. Click on Add application.

    

18. Select Web Api.
19. Click on Next.

    

20. At Identifier enter the value you entered above (or left in place) at Client Identifier.

    

21. You can configure Access Control Policy to your own liking. This policy's setting determine which users will have access to Profit.
22. Click on Next.

    

23. Make sure that the list 'Client application (caller)' contains the Server Application you created before.
24. Turn on 'openid' a the 'Permitted scopes' if this is not already so.
25. Complete the wizard.

Step 2: Determine the endpoint's eddress:

1. Retrieve the OpenId Connect configuratie URL:
2. Go to: AD FS / Service / Endpoints.

   

   Here you'll see an ‘OpenID Connect’ group.

   Note:

   Make sure all endpoints in the 'OpenID Connect' group and the endpoint '/adfs/oauth2' are both enabled and externally available.

3. De URL Path of the ‘OpenID Connect Discovery’ type combined with AD FS server address are the url of the configuration file. You need this when making the link, make a note.

   For example: https://<ADFS-server>/adfs/.well-known/openid-configuration

Tip: Log on automatically using Chrome, Edge and Firefox

Users can log on automatically when they're already logged on to the domein, but by defailt this only works in Internet Explorer. In ADFS you can activate this for Chrome, Edge and Firefox. For more information, see Single Sign on with Chrome, Firefox and Edge with ADFS 3.0

Instead of this, consider migrating to Azure AD overwegen. For more information, see Azure Active Directory Seamless Single Sign-On.

Attention:

This is a general description of the configuration, AFAS doesn't offer support on this. The description is aimed a system engineers that have sufficient knowledge to configure this. Beause of changes carried out by ecternal parties, it may happen that certain aspects or data of this solution have been changed and this documentation is not up to date.

You must later forward the following data to the Profit administrator to activate single sign-on for Open Azure Active Directory:

• OpenID Connect configuration URL: this is the modified link to the Federation Metadata document
• : this is the Application ID that is created when creating an app in Azure.
• : this is the API Access Key.

Step 1: Configure the identity provider:

1. Sign on to portal.azure.com.
2. Search based on app registration and click App registrations.
3. Create a new registration.

   

4. Select the Web type at redirect URI and enter the following URL:

   

5. Register the application.
6. Copy the Application (client) ID. This is the that you need to define later in the AFAS Online login portal.

   

7. Go to: Verification.
8. At the redirect URL, enter:
9. Click Save.

   

10. Go to: Certificates and secrets.
11. Click New client secret, give it a name and select 24 months at Expiry on. Don't forget to make an entry on your to do list or in your dairy to updates this after 24 months.
12. Click Add.

    

13. Copy the new client secret and make a note of it.

    This is the Client Secret that you need to define later in the AFAS Online login portal.

    

14. Go to API authorisations and check whether the User.Read authorisation has been allocated. This is the default case:

    

    If an authorisation has not been allocated, follow the following steps:

    • Click Add an authorisation and, next, select the Microsoft Graph API.

      

    • Select the Delegated authorisations authorisation type.

      

    • Scroll down and select the User.Read. authorisation under the User authorisation type.
    • Click Add authorisation.

      

15. Click Overview / End points.

    

16. Make a note/copy the value at OpenID Connect document with metadata. This is the OpenID Connect configuration URL that you must later define in the AFAS Online login portal.
17. Create a claim (often a link is created using 'UserPrincipalName'. Therefore, enter an 'Optional claim' of the 'Id' type on the 'upn' field. Click 'Token configuration' on the left and add the claim.

    

Linking to another claim than UPN

If you want to link to another claim and not UPN (part of the scope profile), create an optional claim by going to Token configuration.

Linking SSO based on Office 365 is very similar to linking SSO based on Azure AD. The user identity of an Office 365 user is, after all, recorded in an Azure Active Directory that is part of your subscription.

Procedure:

1. Sign on through https://portal.office.com/adminportal on the Admin Centre of Office.com.
2. You can also access this as follows if you have signed on to Office.com:

   

3. You will see ‘Admin centres’ at the bottom on the right. Open this menu.
4. Click ‘Azure AD/Azure Active Directory’.

   

5. Carry out the steps of the SSO link using Open Azure AD based on Connect OpenID.

For more information, see the HelloID documentation.

You can create an application through the procedure below to sign on to AFAS Online with the Okta link.

To activate single sign-on for Okta you must later on record the following data in the AFAS Online Portal:

• ClientID
• ClientSecret
• OpenID Connect URL
• Claim based on which the UPN must be matched

Procedure:

1. Okta will issue a URL, username and password.
2. Create a new application.

   

3. Click: Add application.

   

4. Click on: Create new app.

   

5. Select Web in Platform.
6. Select OpenID Connect in Sign-on method.

   

7. Provide a description for the application
8. Enter the following in Login redirect URIs:

   https://sts.afasonline.com/signin-oidc

9. Click Add URl in Logout redirect URIs.
10. Enter the following: https://sts.afasonline.com/signout-callback-oidc

    The screen with the settings of the application will be displayed.

    

    Here you will find the ClientID and Client secret fields (click Show to see the Client secret).

11. Make a note of these fields.

    

12. Click on: Sign on.

    

    You will find the URL of the issuer, for example:

    https://afas-test.okta.com

13. This URL is the 'OpenID Connect meta data url' for the configuration on login.afasonline.com. Make a note of this.

UPN field:

The Profit administrator must be aware of what must be entered in Profit in the UPN field of users. Therefore, ensure that it is clear to the Profit administrator where the administrator can find the information or retrieve it and which formatting is used within this context. For example, p.richards@enyoi.com instead of peter.richards@enyoi.local).

Use the following steps to create an SSO connectin with tje OpenID Connect protocol using SecureLogin as Identity Provider (IDP).

Attention:

By default, this option is not enabled in your environment. Please contact the SecureLogin Helpdesk via support@securelogin.nu.

T

To activate single sign-on for SecureLogin, you should later enter the following data on the AFAS Online Portal:

• AFAS Config URL
• AFAS Client ID
• AFAS Client Secret
• Scope
• Claim

Procedure SecureLogin Manager:

1. Click on and select AFAS OpenID
2. In the next window, enter the 5-digit environment code of the AFAS envirironment And click AFAS OpenID inschakelen.

   

3. Then you will see the following screen, with the values required for the AFAS Online Portal. Copy the values to the clip board using the Kopiëren button.

   

UPN

The UPN selected by the Profit manager, should match the user name used for logging on to SecureLogin. Use the Exporteer gebruikers als CSV function to create an overview of the user names SecureLogin.

Use this procedure if you want to use single sign-on through SURFconext. AFAS had a generic contract with SURFconext that is available to all AFAS customers.

SURFconext as the broker in relation to the SURFconext link. You must be a customer of SURFconext and you will therefore also maintain the contacts with SURFconext.

An existing contract will be used in relation to single sign-on for AFAS Online via SURFconext, that is, between the server/identity provider of the customer and SURFconext AND between SURFconext and AFAS Online. The parties must only just agree and configure that the customer will be in contact with AFAS Online for single sign-on through SURFconext. After everything has been configured and arranged, AFAS Online will be available in the SURFconext dashboard.

More information:

• SurfConext Wiki (technical documentation)

Step 1: Configure the identity provider:

1. The organisation has often already made a link between the identity provider and SURFconext. If this is not the case, read the SURFconext documentation.

Step 2: Link the instance of AFAS to SURFconext

1. Contact support@surfconext.nl to again access to the Service Provider Dashboard. Use this dashboard to link your instance to SURFconext. For more information, view https://wiki.surfnet.nl/display/surfconextdev/SP+Dashboard.

Step 3: Forwarding data to the Profit administrator

UPN field:

The Profit administrator must be aware of what must be entered in Profit in the UPN field of users. Therefore, ensure that it is clear to the Profit administrator where the administrator can find the information or retrieve it and which formatting is used within this context. For example, p.richards@enyoi.com instead of peter.richards@enyoi.local).

For SURFconext the UPN fields in Profit must contain the 'Edu_person_principal_name' value. They are known at SURFconext. If you do not have them, contact SURFconext.

You configure Active Directory Federation Services on a Windows Server.

Read the information below and, next, perform the steps.

Additional system requirements:

For ADFS 3.0 Server 2012 R2 is required. For later versions of Windows Server, use OpenID Connect!

The link is made based on oAuth 2.0.

Refer to the relevant Microsoft documentation for more information.

Configuration requirements:

You need the following data to activate SSO for Active Directory Federation Services:

• The URL of the AD FS that you configured.

  Example: https://<ADFS-server>/FederationMetadata/2007-06/Federationmetadata.xml

• The AD FS server must be accessible externally (from outside the company network) via the following address:
  • https://<ADFS-server>/FederationMetadata/2007-06/Federationmetadata.xml
  • https://<ADFS-server>/adfs/oauth2/token

  Note:

  Only configure the link through Self-service on the portal when this address is accessible externally. If Federationmetadata.xml is not accessible externally, the link with AFAS cannot be achieved.

What do you need on AFAS Online?

You must make a note of the following data during the configuration process. You will need this data later on to link AFAS Online to your AD FS.

OpenID Connect configuration URL: AD FS URL of the metadata URL

: the unique value that you provide yourself

Step 1: Create a new oAuth 2.0 client:

1. Execute the following commands in PowerShell (with admin rights):

   Add-AdfsClient -Name "AFAS Online" -ClientId "<my_client_id>" -RedirectUri "https://sts.afasonline.com/signin-oidc"

   Add-ADFSRelyingPartyTrust -Name "AFAS Online Trust" -Identifier "https://sts.afasonline.com"

   * replace <my_client_id> by your own unique value, for example: 9CEDCF985C03436885E6F22E4D17236E

Step 2: Configuring the identity provider for Relying party trust:

1. Open the ADFS Management tool on the Windows Server.
2. Go to: AD FS/Service/Endpoints.

   

3. You will find the URL path for the OpenID Connect configuration URL field in the portal in AFAS in the 'Metadata' label.

   The URL path of the ‘OpenID Connect Discovery’ type in combination with the address of the AD FS server forms the URL of the configuration file that AFAS requires.

   For example: https://<ADFS-server>/FederationMetadata/2007-06/Federationmetadata.xml

   

4. Ensure that the above selected endpoints are enabled and available externally (!).
5. Go to: AD FS/Trust Relationships/Relying Party Trusts.

   

6. Select the just created Trust: AFAS Online Trust.
7. Click the action: Edit Claim Rules… in the right menu.

   

8. Go to the tab: 'Issuance Transform Rules'.
9. Click on: 'Add rule'.

   The 'Add Transform Claim Rule Wizard' window will be displayed.

10. Select: 'Send LDAP Attributes as Claims'.

    

11. Click on: 'Next'.
12. Define the claim. This will define the data that will be sent back when authentication is successful in relation to AFAS Online.
    1. Enter a description in 'Claim rule name'. For example, UPN.
    2. Select 'Active directory' in 'Attribute store'.
    3. Select a value for 'LDAP attribute'.

       You may choose any value in relation to this field. The 'User-principal-name' value is recommended.

    4. Select 'UPN' in the list in 'Outgoing claim type'.

       This will determine the value with which the UPN will be filled. This must be unique for every user to be authenticated. You must also link this value in Profit Windows for each user. We recommend using a simple or recognisable value such as the user code or the email address of the user.

       

13. Click on: 'Finish'.

    You have now created one rule. You create another one.

14. Click the action: Add rule...

    

15. Select a 'Claim rule template'. For example, Permit All Users so that all ADFS users can have access to AFAS Online. This is the simplest option. However, you are free to configure this as you see fit.
16. Click Next.
17. Click Finish.

Step 6: Administrator transfer

The Profit administrator must be aware of what must be entered in Profit in the UPN field of users. Therefore, ensure that it is clear to the Profit administrator where the administrator can find the information or retrieve it and which formatting is used within this context. (For example, p.jansen@klant.nl instead of piet.jansen@klant.local).

The system administrator will let you know what needs to be entered in the UPN (User Principal Name) field. The Profit administrator enters the UPN by completing the steps below.

Note:

The user's password will be reset when you enter the UPN. This is why the user must be aware of how he or she signs on to Profit by means of single sign-on.

If the user also has access to OutSite, he or she can no longer sign on to the OutSite site either (since his/her password has been reset). The user can request a new password when signing on to the OutSite site itself.

1. Go to: General / Management / Authorisation tool.
2. Open the properties of the user.
3. Enter the UPN (that you received from the system administrator).

   

   If you cannot enter the code, AFAS will not have yet processed the incident for implementing single sign-on.

4. Click on: OK. You will now have linked the UPN to the user!

1. Go to https://login.afasonline.com/12345.

   Replace 12345 with your own participant number in this URL.

2. Next, a screen will be displayed with the AFAS Online applications. Click the ‘Profit’ tile to open Profit.
3. If this works, continue with the next step.

The UPN of the users must be entered before they can sign on using single sign-on.

If you are doing this for a limited number of users, enter the UPNs manually. See for an explanation the section above: Step 1 Entering a UPN of one user.

If you have a large number of users for whom the UPN field must be entered, you can import them through the import ‘User entry’.

See also:

• Importing users.