Administrators can set up a secure connection between YuJa Engage and ADFS to authenticate users logging into YuJa Engage. To securely authenticate and log in users, please ensure YuJa Engage and ADFS have been configured by following the steps below.
What Is Required for the ADFS Configuration
The ADFS configuration requires three steps, as listed below.
- Creating a Relying Party Trust (RPT) with Engage.
- Add claim rules for the RPT so that SAML responses contain the correct information about the user.
- Adjusting the hash algorithm of the RPT. This ensures that all 3 parts are completed so that the configuration is done properly.
Creating a Relying Party Trust
Before proceeding with the steps below, please ensure you've received your Relying party SAML 2.0 SSO Service URL from your Customer Success Manager.
- On the ADFS server, open the application ADFS Management. In the left panel, under Trust Relationships, click on Relying Party Trusts (RPT).
- In the Actions tab, click on Add Relying Party Trust.
- In the Add RPT Wizard window, click Start.
- Select Enter data about the relying party manually.
- Click Next.
- Enter a display name for the RPT (e.g. “YuJa Engage”). Click Next.
- Select ADFS Profile and click Next.
- On the Configure Certificate step, click Next. Do not encrypt claims sent to YuJa.
- Select Enable support for the SAML 2.0 WebSSO protocol. Enter the Relying party SAML 2.0 SSO Service URL you received from your Customer Success Manager and click Next.
- For the Relying party trust identifier, enter: “https://<YOUR_YUJA_ENGAGE_DOMAIN>.engage.yuja.com” without the quotations. Click Add, then click Next.
- Select I do not want to configure multi-factor authentication settings for this relying party trust at this time. Click Next.
- Select Permit all users to access this relying party. Click Next.
- Review the settings to make sure everything is correct, then click Next.
- Make sure to have Open the Edit Claim Rules dialog for this relying party trust when the wizard closes selected, then click Close.
Adding Claim Rules
- To create/edit claim rules, first, click on the RPT. On the right-side panel, click Edit Claim Rules.
- In the Edit Claim Rules for YuJa Engage window, click Add Rule.
- Select Send LDAP Attributes as Claims and click Next.
- Enter a Claim rule name (e.g. YuJa Engage).
- Select Active Directory as the Attribute Store.
- Create four claim mappings as shown in the table below, and then click Finish.
Mapping of LDAP attributes to outgoing claim types:
LDAP Attribute Outgoing Claim Type Email-Addresses E-mail Address Given-Name Given Name Surname Surname <An attribute relating to the role of a user(e.g. ITManager)> Role
- Now, create a second claim rule. Click Add Rule.
- Select Transfer an Incoming Claim. Click Next.
- Enter a Claim rule name. For Incoming claim type, select E-Mail Address. This is assuming that each user in the ADFS system has an e-mail address associated with them. If this is not the case, select Given Name instead.
- For Outgoing claim type, select Name ID. For Outgoing name ID format, select Email.
- Click Finish.
- Click OK in the Edit Claim Rules window.
Adjusting the Hash Algorithm
YuJa Engage Configuration
After you've adjusted all settings in ADFS, you will be able to configure settings within YuJa Engage.
- Log in to YuJa Engage as an IT Manager.
- Click Integrations from the left-side navigation menu and select SSO - ADFS [SAML] from the drop-down list.
- You will need to fill out the information for each of the panels for the integration—General SSO Details, User Provisioning, Role Mapping, and Cross Integration with LTI. Follow the table below to fill out the information.
Attribute Required? Description General SSO Details ADFS SSO URL Yes
The URL used for the SSO. This is where YuJa Engage will send AuthnRequest tokens. Found in the IDP metadata as the “Location” attribute. Note: For Engage, an HTTP-Redirect binding is used.
Name ID Format Yes
The format to be used by the SP and IDP when communicating about a subject. Found in the IDP metadata as the value of that tag. Note: If available, email addresses should be prioritized and used.
Example: urn:oasis:names:tc:SAML:1.1:nameid- format:emailAddress
Remote Logout URL Currently not supported Leave this value blank. ADFS Signing Certificate Fingerprint Yes
The unique fingerprint of the IDP’s certificate is used when signing SAML responses. The thumbprint is not explicitly located in the metadata, but the certificate is used to sign either the SAMLResponse or the Assertion. See How to derive the fingerprint of a certificate in the Additional Tools section of this document for more details.
Logout URL Currently not supported
Leave this value blank.
User Provisioning Given Name Attribute No
The name of the attribute in the SAML response describes the user's given name (i.e. first name). Found in the IDP metadata. There is a section in the .XML file that should contain a list of tags. Enter the value for the “Name” key, under the appropriate given name.
The value should be: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
Family Name Attribute No
The name of the attribute in the SAML response describes the user's family name (i.e. last name, surname). Found in the IDP metadata. There is a section in the .XML file that should contain a list of tags. Enter the value for the “Name” key, under the appropriate family name.
The value should be: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
Email Attribute No
The name of the attribute in the SAML response describes the user's email address. Found in the IDP metadata. There is a section in the .XML file that should contain a list of tags. Enter the value for the “Name” key, under the appropriate email address.
The value should be: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
Role Attribute No
The name of the attribute in the SAML response describes the user's role. Found in the IDP metadata. There is a section in the .XML file that should contain a list of tags. Enter the value for the “Name” key, under the appropriate role.
The value should be: http://schemas.microsoft.com/ws/2008/06/identity/claims/role
Role Mapping IT Manager No
A comma-separated list of values can be used. If the value received in the Role Attribute matches any of these values, the user will be provisioned as an IT manager.
Example: IT Manager
A comma-separated list of values can be used. If the value received in the Role Attribute matches any of these values, the user will be provisioned as an instructor.
Example: Instructor, Teacher, or TA
Cross Integration with LTI Linkage Attribute No A unique attribute that links the SSO with the LMS. This allows a user to be recognized as a single user regardless of whether they log in with their SSO or LMS (eg attribute: email)
Once you have adjusted all required settings, click Save All Changes to complete the integration with ADFS.