Active Directory Federation Services (AD FS) is a technology that extends your Active Directory configuration to services outside of your infrastructure.
This guide was done in Windows Server 2012 Standard, although other recent versions of Windows should work just fine with Blissbook.
Note: AD FS is no longer the recommended path. Most customers use SAML 2.0 or a simple, generic Azure AD integration instead. You will not see an AD FS button in Blissbook unless you first contact our support team.
Outline
Add a Relying Party Trust
Edit the Claims Rules for the Relying Party Trust
Edit Relying Party Trust Properties
Export the Certificate
Add a Relying Party Trust
From the AD FS console > Trust Relationships > Relying Party Trusts, click the Add Relying Party Trust… link.
Click Start to begin the wizard.
Select "Enter data about the relying party manually," then click Next.
Enter "Blissbook" as the Display name for the Relying Party Trust, then click Next to continue.
Select "AD FS profile," then click Next.
You will not need a token encryption certificate, so click Next to continue.
Check the "Enable support for the SAML 2.0 WebSSO protocol" box, then click Next. Enter the URL in the following format, replacing "my-subdomain" with your Blissbook subdomain: https://my-subdomain.blissbook.com/auth/adfs.
Add your Blissbook subdomain as the Relying party trust identifier, then click Next.
Select "I do not want to configure multi-factor authentication settings for this relying party trust at this time." Then click Next.
Select "Permit all users to access this relying party," then click Next.
Review your settings, then click Next.
Click Close to finish the wizard.
Edit the Claims Rules for the Relying Party Trust
Click Add Rule….
Select "Send LDAP Attributes as Claims," then click Next.
Enter "Get Attributes" as the Claim rule name.
Select "Active Directory" as your Attribute store.
Select "E-Mail-Addresses" as the LDAP Attribute and "E-Mail Address" as the Outgoing Claim Type.
Select "Display-Name" as the LDAP Attribute and "Name" as the Outgoing Claim Type.
Click Finish.
Click Add Rule… again.
Select "Transform an Incoming Claim," then click Next.
Enter "Name ID Transform" as the Claim rule name.
Select "E-Mail Address" as the Incoming claim type.
Select "Name ID" as the Outgoing claim type.
Select "Email" as the Outgoing name ID format.
Click Finish.
Click OK.
Edit Relying Party Trust Properties
Right click on your new Relying Party Trust (Blissbook), then click Properties.
From the Properties window, select the Advanced tab.
Change the Secure hash algorithm to "SHA-1," then click OK.
Export the Certificate
From AD FS > Service > Certificates, right click on your Token-signing certificate and click View Certificate….
Go to the Details tab.
Click Copy to File….
When the wizard starts, click Next.
Select "DER encoded binary X.509 (.CER)" as the format, then click Next.
Choose a location to save your certificate by clicking Browse…, and then click Next.
Click Finish to end the wizard.
Click OK if the export was successful.
Convert the certificate from DER format to PEM. Go to sslshopper.com, then click "SSL Converter - Convert SSL Certificates to different formats."
Select your certificate using the Browse… button.
Select "DER/Binary" in the Type of Current Certificate drop down menu.
Select "Standard PEM" from the Type To Convert To drop down menu.
Click Convert Certificate.
Open your certificate with a text editor (e.g. Notepad) and copy the contents.
Log in to your Blissbook account, then go to your Single Sign-On settings: click ORGANIZATION in the main nav, click the settings slider icon in the left nav, look for the "Via Single Sign-On (SSO)" section, then click the Enable SSO button. Choose Active Directory via AD FS.
Paste your certificate within the X.509 Certificate field. Above it, enter your Login URL. Typically it's the URL to your AD FS service with /adfs/ls/ appended to it.
All done! Grab yourself a handful of Oreos and celebrate.