To set this up, you’ll need to provision a new “Relaying Party Trust” in the “AD FS Management” tool on your windows server.

First, you’ll need download and keep handy the request signing certificate for Stax,
This can be found here.

You'll also need your relying party trust identifier and callback URL as provided by the stax team.

Once open, please:

  1. In the right sidebar, click “Add Relying Party Trust”
  2. Choose “Claims aware” and press “Start”.
  3. Press "Enter data about the relying party manually" and then next.
  4. Choose an appropriate name (e.g. “Stax Spotlight ADFS”) and press Next.
  5. Press “Next” without specifying an encryption certificate.
  6. Check "Enable support for SAML 2.0 WebSSO Protocol", and put the callback url we've provided to you. Press "Next"
  7. Enter your relying party trust identifier, press “add” and then “next”
  8. Choose what level of access you wish to allow, e.g. “Permit everyone” or just "Permit specific group", Press "Next".
  9. Click next, And ensure the “Configure claims issuance policy” is checked before continuing.
  10. Click close.
  11. On the right side of the screen, click “Edit Claim Issuance Policy”
  12. Click “Add Rule”
  13. Ensure “Send LDAP Attributes as Claims” is selected and press next
  14. Give the policy a name, select “Active Directory” for the store then set up a mapping like so:
  • Map LDAP “E-Mail-Addresses” to outgoing “E-Mail Address”
  • Map LDAP “Display-Name” to outgoing “Name”
  • Map LDAP “User-Principal-Name” to outgoing “Name ID”
  • Map LDAP “Given-Name” to outgoing “Given Name”
  • Map LDAP “Surname” to outgoing “Surname”
  1. Click “Finish”, "Apply", then "OK"
  2. Select your Relying Party Trust, and click “Properties” on the right side.
  3. Choose the “Signature” tab
  4. Click “Add”, and browse to the provided certificate for Stax.
  5. Hit "Add" and then "Apply".

Once that’s configured, you’ll need to send us your Federation Metadata XML url, and we’ll configure it on our side and test with you.

IF you wish to set up role-based access, Please get in touch with support and we'll work with you to pass through custom claims and map them on our side.

Did this answer your question?