---
title: "📋 SSO: Setting up SAML Single Sign-On with ADFS"
url: "https://support.ftapi.com/en/article/einrichten-des-saml-single-sign-on-mit-adfs"
language: "en"
last_updated: "2026-06-22T07:11:33.936Z"
---

# 📋 SSO: Setting up SAML Single Sign-On with ADFS

In this guide, you will learn step-by-step how to configure SAML Single Sign-On (SSO) for your FTAPI instance using Microsoft ADFS (Active Directory Federation Services).

ADFS is a service provided by Microsoft as a standard role for Windows Server that enables web login using existing Active Directory credentials.

## Requirements

For ADFS login to your FTAPI instance, you need:

-   An Active Directory instance with an email address attribute for each user.
-   A server running Microsoft Server 2016 to 2025.
-   An SSL certificate to sign your ADFS login page.

Information on installing the AD FS role service can be found at Microsoft:   
[https://learn.microsoft.com/de-de/windows-server/identity/ad-fs/deployment/install-the-ad-fs-role-service](https://learn.microsoft.com/de-de/windows-server/identity/ad-fs/deployment/install-the-ad-fs-role-service)

## Adding a Relying Party Trust

1.  In `AD FS Management`, select the `Relying Party Trusts` folder and add a new `Relying Party` via the context menu (right-click) or the `Actions` sidebar. The configuration wizard for a new trust will start.   
    ![](https://cdn-assets.productfruits.com/089a33b3-635a-4b91-a2ad-13046bb1347e)
2.  Select `Claims aware` and click `Start`.   
    ![](https://cdn-assets.productfruits.com/092be1ed-d321-4195-9ba0-b51f2d0308de)
3.  If the AD FS server has direct internet access, select the first option and enter the URL of your FTAPI instance with the suffix `/saml/metadata`. You can also find the URL in the administration of your FTAPI server under `Single Sign-On SAML 2.0` -> `Relying Party (RP) Metadata URL`.   
    ![](https://cdn-assets.productfruits.com/b468f19c-8312-4983-970a-e75b96e20c5b)
4.  If the AD FS server does not have direct internet access, download the aforementioned metadata and provide it under point 2 `Import data about the relying party from a file`. Click `Next`.   
    ![](https://cdn-assets.productfruits.com/72af965a-cda7-42cb-bcbb-85f5dd45a58a)
5.  Enter a unique name.   
    ![](https://cdn-assets.productfruits.com/dff6024a-8105-463f-934e-c274b73a7ba7)
6.  Select `Permit everyone` or `Permit a specific group` and click `<Parameter>`. In the window that opens, you can now select dedicated AD groups whose members should have access to SSO via SAML.   
    ![](https://cdn-assets.productfruits.com/a2a24211-444d-4bb0-bb32-e9f26fb77ced)   
    Click `Next` twice and then `Close` to finish the wizard and save the configuration.   
    ![](https://cdn-assets.productfruits.com/09d76ca9-38fe-4785-bb01-a38c0d514d8e)

## Claim Issuance Policy

The `Claim Issuance Policy` opens automatically after closing; alternatively, right-click the newly created party and select `Edit Claim Issuance Policy...`.   
![](https://cdn-assets.productfruits.com/3611d7fb-2f72-44cb-884b-9bea812b5b55)

1.  Click `Add Rule` and select `Send LDAP Attributes as Claims`.   
    ![](https://cdn-assets.productfruits.com/ff94b287-f31d-429f-a67b-cc0b3015fc55)   
    The claim rule name can be chosen freely, e.g., `FTAPI - SSO`. `Active Directory` must be selected as the attribute store.   
    The mapping should look like this:   
    ![](https://cdn-assets.productfruits.com/f7e37fe9-bdce-4a4a-9c26-48b7eeabbd7f)   
    If desired, further LDAP attributes can be configured (the FTAPI server also supports first name, last name, company, phone number, and position).

## Group Mapping

If group mapping is to be used, please configure corresponding AD groups for the FTAPI groups. Under `Add Rule...`, select `Send Group Membership as a Claim`.   
![](https://cdn-assets.productfruits.com/d176dbc9-011a-4d42-a73a-c579186271d8)

-   **Claim rule name:** Free text, should correspond to the group
-   **User's group:** The local AD group
-   **Outgoing claim type:** Role or Group, depending on the configuration on the FTAPI server
-   **Outgoing claim value:** Name of the FTAPI group

![](https://cdn-assets.productfruits.com/a49c6e0b-ee66-4aab-9287-46c8ce98d629)   
The predefined FTAPI groups `Administrator`, `Employee`, and `Guest` have the internal designations `GROUP_ADMIN`, `GROUP_EMPLOYEE`, and `GROUP_GUEST`. For your own FTAPI groups, enter these under `Outgoing claim value`.   
Add all required groups and click `Apply`.

## Adjusting the Token Lifetime

The validity period of the SAML authentication token is controlled via the `Web SSO lifetime`; the default value is `480 minutes`. The value can be increased to a maximum of 9999 minutes (approx. one week).

## Enable Message Signing (Encrypted Assertion)

For the Single Sign-On procedure via SAML to continue working for the FTAPI platform, the encrypted assertion must be active.

## **Related Articles**

> #### [**❓ SSO: Adjusting token lifetime on the ADFS server via PowerShell and console**](https://support.ftapi.com/de/article/sso-token-lifetime-am-adfs-server-via-powershell-und-konsole-anpassen)

> #### [**❓ SAML IDP configuration for encrypted assertions**](https://support.ftapi.com/de/article/saml-idp-konfiguration-bei-verschlusselten-assertionen)