Knowledge Base

AD FS SSO setup

Step 1: Configure Teamwork.com on your AD FS server

1. Open Server Manager.
   
2. Under Tools, select AD FS Management.
   
3. Select Add Relying Party Trust on the AD FS view's right.
   
4. Click Start.
   
5. Choose Import data about the replying party published online or on a local network.
   
6. Enter your Teamwork.com site's metadata URL in the following format:
   
   https://yoursitename.teamwork.com/singlesignon/v1/saml/metadata
   
7. Enter Teamwork.com as the relying party.
   
8. Add any additional notes, if relevant.
   
9. Configure multi-factor authentication and issuance rules as desired. Do not enable MFA and permit all users to authenticate.
   
10. Review the settings pulled in from the federation metadata. This can be found under the Ready to Add Trust subsection.
    
11. Check the edit claim rules checkbox to edit claims and finish the setup. We cover how to edit the claim rules in the next section.
    

1. Select the Issuance Transform Rules tab.
   
2. Click Add Rule. This is where you'll set up the information you want to pass to Teamwork.com.
   
3. Select the Send LDAP Attributes as Claims template.
   
4. Click Next.
   
5. Enter a name for the rule. 
   
6. Click the Attribute store dropdown and select Active Directory.
   
7. Map the attributes you want to pass to Teamwork.com. We recommend at minimum passing the following:
   

   LDAP Attribute	→	Outgoing Claim Type
   Given-Name	→	givenname
   Surname	→	lname
   E-Mail-Addresses	→	email

   LDAP Attribute	→	Outgoing Claim Type
   Given-Name	→	givenname
   Surname	→	lname
   E-Mail-Addresses	→	email

8. Click OK to save the rule.
   
9. Click Add Rule to create an additional rule.
   
10. Select Transform an Incoming Claim.
    
11. Enter a name for the rule. Ex. "Name ID."
    
12. Set the Incoming Claim type to UPN.
    
13. Set the Outgoing claim type to Name ID.
    
14. Set the outgoing name ID format to Transient Identifier.
    

     
    
    
    
    
    
15. Click OK.
    

You can set up a group membership claim rule in AD FS to restrict who can log in to Teamwork.com. Use issuance authorization directly at AD FS-level and let the application handle authorizing users. This is a recommended way to handle Active Directory group-based roles.

1. Select the Issuance Transform Rules tab.
   
2. Click Add Rule. This is where you'll set up the information you want to pass to Teamwork.com.
   
3. Choose the Send group membership as a claim template.
   
4. Select the group you want to utilize in Active Directory.
   
5. Set an outgoing claim value. Tip: Send the Group SID.
   

Logging in to Teamwork.com

• Existing Teamwork.com users can log in to Teamwork.com using AD FS SSO or their standard login (using email and password).
  
• When an existing Teamwork.com user signs in via SSO, the sign-in process connects to the existing user based on their email address.
  
• If the email address used as part of the SSO process is different to the existing user in Teamwork.com, you can add an the user's Active Directory email address as an alternative email address in their Teamwork.com profile to connect them.
  
• The AD FS SSO process will only work for a user if that user has an email address defined in the Active Directory.
  

• If someone signs in to Teamwork.com via SSO and does not exist in Teamwork.com, the user is created automatically in Teamwork.com.