Wordbee permits authentication of users by your Microsoft Active Directory Server or your Microsoft Azure Active Directory.
Prerequisites are:
- Active Directory version 2012 or later (ADFS), or
- Azure Active Directory Azure AD.
- A Wordbee Translator Enterprise level license
These are the steps to make the integration happen:
Step 1 - Adding a Relying Party Trust
All steps are done using the ADFS configuration manager. Note that the screens for Azure AD are different:
Add relying party trust
Click Add relying Party Trust in the Actions panel.
Select a display name
This display name is just the name under which you will find your configuration on your ADFS. It has no impact on the configuration.
Tick AD FS profile option
No certificate required here
Enable support for the SAML 2.0 WebSSO protocol
The Relying Party SAML 2.0 SSO service URL (also called Endpoint URL) is the URL which will forward the users to your authentication portal.
It should have been provided by Wordbee in the "SSO - Configuration Information" document.
Relying Party trust identifier
The Relying party trust identifier (also called Service Principal Name) is the unique ID that will be used between our services. A suggested ID should have been provided by Wordbee in the "SSO - Configuration Information" document.
It can be changed if you prefer but should be the same on Service Provider and on Identification Provider, please let us know if our suggestion doesn't match your preferences.
This screen allows you to configure multifactor, which is out of scope of this guide.
Permit all users to access this relying party
It is possible to set the default behavior as "deny" and grant only specific users access to your platform, but this configuration is out of scope for this guide.
The next steps of the wizard are only to verify and finish your configuration. Uncheck the box "Open the Edit Claim Rules dialog...", we will configure them later.
Signature encryption
Some configuration can not be done using this Wizard, to proceed further, open the properties of the freshly created relying party trust.
It is located in your ADFS management console in "Trust Relationships > Relying Party Trusts" under the display name you set earlier.
On the "Signature" tab, upload the public certificate provided by Wordbee.
Hash Algorithm
Under "advanced" tab, make sure SHA-256 is selected.
Step 2 - Creating claim rules
Claim rules are used here to define which user information will be send to our server.
You can configure them in your ADFS management console in "Trust Relationships > Relying Party Trusts", right click on the Wordbee-Translator Relying Party Trust and "Edit Claim rules"
"Add Rule" and "Send LDAP Attributes as Claims"
Select the attributes to send
To make it work with Wordbee-Translator, you will at least need to send e-mail-addresses as "e-mail address". More attributes can be requested by Wordbee to match your specific needs.
"Claim rule name" is just a friendly name and "Attribute store" should be Active Directory.
Step 3 - Activation by Wordbee
Your ADFS is ready at this stage!
We now require you to send us your:
- Your public certificate
- Your Active Directory endpoints.
- Your field mappings
These details are required by Wordbee to activate the authentication in your Wordbee Translator platform
Extract your public certificate
This certificate can be found on your ADFS management console, under Service > Certificates, select the token signing cert and clic "View Certificate"
Go to details tab, clic "copy to file"
This should open the Certificate export wizard, export it in Base 64 file.
This file does not include the private key and can be safely sent via mail.
SSO - Configuration information document
In this document, we expect you to fill the "Contact details" part and the "Identity Provider Data for the AD FS PRODUCTION environment"
Identity Provider Name
The Identity Provider Name is also called "Federation Service Identifier" and can be found in the Federation Service Properties of your ADFS as shown on the screenshots below.
Single Sign On service URL
In Service > Endpoints, you can find your SSO Service URL:
Federation Metadata URL
In the same folder, a bit below, you can find your metadata: