Configuring ADFS 2016 (ADFS 4.0)

The following will give a step by step on how to configure QATrack+ as a client application in Active Directory Federation Services 2016 (AD FS 2016).

Adding an ADFS Application Group

First, launch AD FS Management, which can be located in the Start Menu under Windows Administrative Tools:

AD FS Management Link in Start Menu

Add New Application Group

In the left hand panel expand the ‘AD FS’ folder and click on ‘Application Groups’ then click on ‘Add Application Group…’.

Adding an Application Group

In the Add Application Group Wizard set the Name to QATrack+ (or something else if you prefer). In the Template area select Web browser accessing a web application and then click Next >.

Add Application Group Wizard

Set Client Identifier & Redirect URI

On the next page set the Client Identifier to qatrackplus; this is what you will set the CLIENT_ID field to in your AUTH_ADFS settings. Set the Redirect URI to the url of your QATrack+ server with a path of accounts/oauth2/callback (no trailing slash) and then click Add. For example if your QATrack+ server is located at https://qatrack.yourhospital.com then you would set the Redirect URI to https://qatrack.yourhospital.com/accounts/oauth2/callback.

Native Application Page

On the next page leave the Policy as Permit everyone and click Next.

Access Control settings

On the Summary page confirm your settings are correct and click Next then Close.

Settings Summary

You will now have a QATrack+ Application Group showing. Select it and then click Properties in the right hand pane.

App group properties

In the QATrack+ Properties Dialog, select the QATrack+ - Web application item in the Web application section and then click Edit…

QATrack+ App group properties

Click on the Issuance Transform Rules tab at the top of the properties dialog and click Add Rule

Issuance Transform Rules

Set the Claim rule template to Send LDAP Attributes as Claims and click Next.

Select claim rule template

On the next page set the Claim rule name to LDAP Attributes and set the Attribute store to Active Directory. In the Mapping of LDAP attributes to outgoing claim types field set the following attributes:

LDAP Attribute	Outgoing Claim Type
E-Mail-Addresses	E-Mail Address
Given-Name	Given Name
Surname	Surname
Token-Groups - Unqualified Names	Group
SAM-Account-Name	Windows account name

then click Finish:

Setting up the claims

and OK:

Issuance rules set

You can now proceed to configure your QATrack+ application to use AD FS. The settings you will need are:

• SERVER: The HostName of your ADFS server. For example adfs.yourhospital.com. You can retrieve this setting by opening a PowerShell window and entering:

  Get-AdfsProperties | select HostName | Format-List
  

• CLIENT_ID: Use qatrackplus or whatever you set the Client Identifier to above.

  To double check this setting open a PowerShell window and enter:

  Get-AdfsNativeClientApplication -Name "QATrack+ - Native application"
  

  and look for the Identifier field.

• RELYING_PARTY_ID: The Relying Party Identifier will be the same as the CLIENT_ID setting e.g. qatrackplus double check this setting open a PowerShell window and enter:

  Get-AdfsWebApiApplication | select Identifier | Format-List
  

• AUDIENCE: Use the RELYING_PARTY_ID setting but prefixed with microsoft:identityserver: e.g. microsoft:identityserver:qatrackplus