---
title: ADFS-side configuration
slug: kronpam-reference-guide-3-9-0/adfs-side-configuration
docTags: 
createdAt: 2025-10-14T10:02:35.070Z
---

We assume that ADFS role is already installed on environment. 

1-Go to ADFS Management and right click on **Relying Party Trust**



![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/vs4Me2Rrp49MR5hIe7kWl_.blob "ADFS Management")

2-Click on **Add Relying Party Trust** and choose the **Claims aware **option



::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/qpjtVe5x9i9uV9N0SWLh-_.blob" size="58" width="361" height="293" position="center" caption="Add Relying Party Trust Wizard welcome screen" darkWidth="361" darkHeight="293" showCaption="true"}

3-Choose **Enter data about the relaying party manually**, and click **Next**

::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/VdFbBk0Ar067kxpcQHqTb_image.png" size="82" width="589" height="478" position="center" caption="Wizard Data Source Selection" darkWidth="589" darkHeight="478" showCaption="true"}

4-Write A Display name like “Kron PAM ADFS”, click **Next**, and pass the **Configure Certificate** screen

5-In the **Configure URL** section, choose **Enable support for the SAML 2.0 WebSSO protocol**, and fill the URL with below data then click **Next**

:::hint{type="info"}
"kron.pam" stands for the Kron PAM address in the following examples.
:::

https\://kron.pam/aioc-rest-web/servlet/saml/samlRecipient

::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/VuTVKSBAL-ydBuNvWlGad_image.png" size="74" width="673" height="546" position="center" caption="Wizard URL Configuration" darkWidth="673" darkHeight="546" showCaption="true"}

6-In the **Configure Identifiers **section enter the address below for “Relying Party trust identifier”, click the **Add** button, and keep clicking **Next **until the end of the configuration.

https\://kron.pam/aioc-rest-web/servlet/saml/samlCheck

::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/6z4KsBjf10T1PL2aWeOkY_.blob" size="66" width="428" height="348" position="center" darkWidth="428" darkHeight="348" showCaption="false"}

7-After completion navigate to the management page and right click on newly created “Relying party Trust”, then click **Properties**.

::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/PGh2mUTwlfnTrLAX1zZJF_.blob" size="66" width="406" height="266" position="center" darkWidth="406" darkHeight="266" showCaption="false"}

8-On **Properties**, open the “Endpoints” tab and click the **Add SAML** button. Choose SAML Logout as “Endpoint type” and POST as “Binding” option. And as “Trusted URL” please enter below data then click ok.

https\://kron.pam/aioc-rest-web/servlet/saml/samlLogout

::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/A6WZYxTBOG9mvQpNem0e9_.blob" size="78" width="446" height="327" position="center" darkWidth="446" darkHeight="327" showCaption="false"}

9-Then click the **Apply **button to finish this configuration.

::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/6lnCqCV3IWRQpy47tTljd_.blob" size="52" width="220" height="258" position="center" darkWidth="220" darkHeight="258" showCaption="false"}

10-Right click “Relying Party Trust” again and choose “Edit Claim Issuance Policy” 

::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/bAUBsIUqMHQXTR4tD-uYR_.blob" size="72" width="522" height="236" position="center" darkWidth="522" darkHeight="236" showCaption="false"}

11-On the windows that pops up, click “Add rule” and choose “Send LDAP Attribute as Claims” for Claim rule template. Then click **Next.**

::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/eDpm_Xl3Ye2z_OfvvuYGU_.blob" size="72" width="505" height="246" position="center" darkWidth="505" darkHeight="246" showCaption="false"}

12-On the section below, give a name for the Claim Rule and choose the appropriate option for your actual infrastructure. Claims are sent to Service provider. In the example below, sAMAccountName is taken from Active Directory and being sent as Name ID to Kron PAM. If users are imported from AD to Kron PAM without domain information, the config below should work. Otherwise, LDAPAttribute should be chosen accordingly.

::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/VTXPnaMtudDPy6snO-oj7_.blob" size="64" width="406" height="335" position="center" darkWidth="406" darkHeight="335" showCaption="false"}