ADFS-side configuration

we assume that adfs role is already installed on environment 1 go to adfs management and right click on relying party trust 2 click on add relying party trust and choose the claims aware option 3 choose enter data about the relaying party manually , and click next 4 write a display name like “kron pam adfs”, click next , and pass the configure certificate screen 5 in the configure url section, choose enable support for the saml 2 0 websso protocol , and fill the url with below data then click next "kron pam" stands for the kron pam address in the following examples https // kron pam /aioc rest web/servlet/saml/samlrecipient 6 in the configure identifiers section enter the address below for “relying party trust identifier”, click the add button, and keep clicking next until the end of the configuration https //kron pam/aioc rest web/servlet/saml/samlcheck 7 after completion navigate to the management page and right click on newly created “relying party trust”, then click properties 8 on properties , open the “endpoints” tab and click the add saml button choose saml logout as “endpoint type” and post as “binding” option and as “trusted url” please enter below data then click ok https //kron pam/aioc rest web/servlet/saml/samllogout 9 then click the apply button to finish this configuration 10 right click “relying party trust” again and choose “edit claim issuance policy” 11 on the windows that pops up, click “add rule” and choose “send ldap attribute as claims” for claim rule template then click next 12 on the section below, give a name for the claim rule and choose the appropriate option for your actual infrastructure claims are sent to service provider in the example below, samaccountname is taken from active directory and being sent as name id to kron pam if users are imported from ad to kron pam without domain information, the config below should work otherwise, ldapattribute should be chosen accordingly