AD FS

Example values

The tenant-specific values (the sg_ab12cde parts) show the shape only — Safeguard displays your real ACS URL and SP Entity ID in the Add Provider dialog after you click Save. This table makes it unambiguous which value goes on which side.

In AD FS — the Relying Party Trust (you enter these at the IdP):

In Safeguard — Add Provider → SAML 2.0 (you copy these from the IdP):

-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAX...(full cert from your IdP)...P3B/k0SolrFYPo
-----END CERTIFICATE-----

1. On the AD FS server, open AD FS Management → Relying Party Trusts → Add Relying Party Trust → Claims aware, and enter data manually.
2. Set the Relying party trust identifier to the SP Entity ID Safeguard shows after Save (this is the Entity ID).
3. Enable SAML 2.0 WebSSO and set its URL to the ACS URL Safeguard shows after Save.
4. Add an Issuance Transform Rule mapping E-Mail-Addresses to the Name ID outgoing claim, format Email.
5. Add a second Issuance Transform Rule mapping E-Mail-Addresses to an outgoing claim type named exactly email — AD FS's default claim types are full URIs, not this short name, and Safeguard needs the literal email attribute separate from the Name ID rule.
6. Export the token-signing certificate under Service → Certificates, and note the SAML 2.0/WS-Federation endpoint under Endpoints (or the federation metadata URL).
7. In Safeguard, click Add Provider → SAML 2.0 → AD FS, and enter the endpoint, Entity ID, and certificate.
8. Grant access under the relying party trust's Access Control Policy.
9. Click Test in Safeguard to confirm.

Common errors: an "MSIS7042: claims required by relying party trust were not present" error means the Issuance Transform Rule mapping E-Mail-Addresses → Name ID is missing, or the signed-in AD account has no email attribute set.