# AD FS

Verkada Command has the ability to integrate with Active Directory Federation Services (AD FS) to allow your users to log in using their existing AD credentials.

Security Assertion Markup Language (SAML) is the language that allows AD FS to communicate to Command to securely grant your users access to your organization.

| Feature           | Supported |
| ----------------- | :-------: |
| OIDC SSO          |     —     |
| SAML SSO          |    Yes    |
| SCIM Provisioning |     —     |
| ECE Support       |     —     |

{% hint style="warning" %}
SAML does not add or invite users to your organization. It simply allows previously provisioned users to log in with their AD credentials, rather than with a Verkada-managed username and password.

If you're interested in syncing domain users and groups to Command, learn more about [SCIM](https://help.verkada.com/command/security/identity-providers/microsoft-entra-id).
{% endhint %}

### Before you begin

To begin the SAML integration, you must [generate your organization's client ID](https://help.verkada.com/command/security/identity-providers/..#generate-client-id) (where the client ID is case-sensitive).

***

## Configuration

### Add relying party trust

{% stepper %}
{% step %}
**Open AD FS Management.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-0ba31d4561b727f567eecac559076c73a04000fc%2F9847060f3019ffdb99c19b45d87f905a7c675f06.png?alt=media" alt="" width="439"></div>
{% endstep %}

{% step %}
**Select Action > Add Relying Party Trust.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-1690f72cd54029a6713bc5ff19a294d648ded3a8%2F15ade22680b9cd3ef7a0df42cae1ed5ae64aa318.png?alt=media" alt="" width="245"></div>
{% endstep %}

{% step %}
**Check Claims aware and click Start.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-6a5450232bc5fa702b81c9d47f57d11134cdde5b%2F2b5264bc0f8ddd135053489200509f757631d743.png?alt=media" alt="" width="360"></div>
{% endstep %}

{% step %}
**Select Enter data about the relying party manually and click Next.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-372e1d26a92ce66952955cc2038f264543f86ac6%2F8ecbc21cae4352c263ffd72d2b53ad2753e2d78a.png?alt=media" alt="" width="360"></div>
{% endstep %}

{% step %}
**Type a Display name (can be anything) and click Next.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-555105089a3c9af67798b56f3a58f4c16b44c427%2F3b979ee73b01fdfb6dba389ca73e6e1e9a36652a.png?alt=media" alt="" width="360"></div>
{% endstep %}

{% step %}
**Specify and optional token encryption certificate (click Browse to specify), then click Next.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-e930274670a3164e42d3c4e4917e263ffd5f1db6%2Fa5d0f1159b5731014ff8f3eb51a512ed0fb21972.png?alt=media" alt="" width="360"></div>
{% endstep %}

{% step %}
**Check Enable support for the SAML 2.0 WebSSO protocol and in the Relying party SAML 2.0 SSO service URL field (substitute&#x20;*****client-ID*****&#x20;with the client ID that was previously generated):**

* For US orgs: <https://vauth.command.verkada.com/saml/sso/%3Cclient-ID%3E>
* For EU orgs: [https://saml.prod2.verkada.com/saml/sso/](https://saml.prod2.verkada.com/saml/sso/%3Cclient-ID%3E)
* For AUS: <https://saml.prod-ap-syd.verkada.com/saml/sso/%3Cclient-ID%3E>

{% hint style="warning" %}
To confirm which region you're located, please [refer to where your organization was created for Verkada](https://help.verkada.com/command/getting-started/get-started-with-verkada-command).
{% endhint %}
{% endstep %}

{% step %}
**Click Next.**
{% endstep %}

{% step %}
**In the Relying party trust identifier field, type the same URL from step 7, and click Add > Next.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-8ee5881f75f07f414cce6443de94b7e81874d4a6%2F6276414bab29de6a1b3da66b681ce805f76425eb.png?alt=media" alt="" width="360"></div>
{% endstep %}

{% step %}
**Configure an appropriate access control policy for this application and click Next.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-07036fa8d3ee0e64197f90c2c7129a7243b56602%2Fea35a8df15a4884a4721012b8203d68fd516854e.png?alt=media" alt="" width="359"></div>
{% endstep %}

{% step %}
**Review the relying party settings and click Next > Close.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-1c7234fc2e21368b5475a5958908e50a0fa42274%2F295c5414f4b0b7286c6fe825071802d63c08c255.png?alt=media" alt="" width="359"></div>
{% endstep %}
{% endstepper %}

### Edit the claim issuance policy

{% stepper %}
{% step %}
**Right-click the newly-created Relying Party Trust and select Edit Claim Issuance Policy.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-310a892d07703279ca8db9cd3af32bcefd449f62%2F17d1533fbc807372d30444bb8764141e2fc8fb80.png?alt=media" alt="" width="183"></div>
{% endstep %}

{% step %}
**Click Add Rule > OK.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-4f23c3b567fedfdc7613383032318f14d2daf9f0%2Fea8170963e2e35cb5bed5232a0f4b8e19b669355.png?alt=media" alt="" width="244"></div>
{% endstep %}
{% endstepper %}

### Add the transform claim rule

{% stepper %}
{% step %}
**Ensure that Send LDAP Attributes as Claims is selected and click Next.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-467fe9293074c0e29d80c6d38f91b89b211f9f63%2Ff05fd763e4b6ee63ddf20b59764e795c0b564057.png?alt=media" alt="" width="359"></div>
{% endstep %}

{% step %}
**Configure these rule settings and (when done) click Finish:**

a. Enter a **Claim rule name** (can be anything).\
b. Under **Attribute store**, ensure that **Active Directory** is selected.\
c. Configure these LDAP attributes to map to the proper **Outgoing Claim Type**:

* E-Mail-Addresses > E-Mail Address
* Given-Name > Given Name
* Surname > Surname

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-9ce6d5307b7ccac9cf61aa8c373e5352405e649f%2F25e9bd6b7b51b1948063ab2520920376e6776cf9.png?alt=media" alt="" width="361"></div>
{% endstep %}

{% step %}
**Under Claim rule template, select Transform an Incoming Claim to add another rule, and click Next.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-d118d6570609d7fef7b5e4f485ac9e109d5a8a66%2F53f7c613f97e804e9e031ebf1a0f2d051a32102e.png?alt=media" alt="" width="359"></div>
{% endstep %}

{% step %}
**Configure the claim rule:**

a. Type a **Claim rule name** (can be anything).\
b. Next to **Incoming claim type**, select **E-Mail Address**.\
c. Next to **Outgoing claim type**, select **Name ID**.\
d. Next to **Outgoing name ID format**, select **Transient Identifier**.\
e. Ensure that **Pass through all claim values** is selected.\
f. Click **Finish**.

<div align="left"><figure><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2FYqU7r0aDqn1FNd65jFNx%2Fimage%20(7).png?alt=media&#x26;token=4242fa92-e60f-454d-bbf9-fb6eb73ea134" alt="" width="359"><figcaption></figcaption></figure></div>
{% endstep %}
{% endstepper %}

#### Go to **https\:///FederationMetadata/2007-06/FederationMetadata.xml** to download your XML metadata file.

{% hint style="danger" %}
**Do not** use Internet Explorer to complete this step; using Internet Explorer may cause issues with the XML file.
{% endhint %}

### Complete the SAML setup on Command

Follow the steps in [Enable SAML for Your Command Account](https://help.verkada.com/command/security/identity-providers/..#upload-saml-xml-metadata) to complete the SAML setup on Command.

### Test the integration

Once the integration is complete, test it.

{% stepper %}
{% step %}
**Open an incognito/private browsing window and go to (where you will replace clientID with the client ID you generated above):**

* For US: <https://vauth.command.verkada.com/saml/login/%3Cclient-ID%3E>
* For EU: [https://saml.prod2.verkada.com/saml/login/](https://saml.prod2.verkada.com/saml/login/%3Cclient-ID%3E)
* For AUS: [https://saml.prod-ap-syd.verkada.com/saml/sso/](https://saml.prod2.verkada.com/saml/login/%3Cclient-ID%3E)

{% hint style="warning" %}
To confirm which region you're located, please [refer to where your organization was created for Verkada](https://help.verkada.com/command/getting-started/get-started-with-verkada-command).
{% endhint %}
{% endstep %}

{% step %}
**You should be taken to your AD FS login page. Try to sign in with your credentials.**
{% endstep %}
{% endstepper %}

If you are redirected to your Command organization—congratulations—the SAML integration was a success!