Skip to main content

 

Cisco Meraki Documentation

How to Configure SAML SSO with ADFS

  1. Last updated
  2. Save as PDF

Overview 

This article explains how to configure Active Directory Federation Services (AD FS) as an identity provider (IdP) for the Cisco Meraki dashboard. 

The steps cover an example of creating the necessary integration with dashboard. Exact implementation may differ based on your environment and Active Directory implementation. However, you must provide the username and role attributes described in this article in the SAML assertion/token. 

Use the pictures and configuration steps in this article only as a guideline, as attribute names may have changed with Windows Server updates. 

Prerequisites 

Before you begin, ensure the following: 

Step-by-step instructions 

Create a relying party trust 

  1. Open the AD FS management console: go to Start > Administrative Tools > AD FS 2.0 Management. 

  1. Select the top-level folder (AD FS 2.0), then choose Add Relying Party Trust from the Actions menu. 

Add-Relying-Party-Trust.png

  1. Select Start to begin configuring a relying party trust for Dashboard. 

  1. Choose Enter data about the relying party manually, then select Next.

Enter-data-manually.png

  1. Enter a Display name, which appears in the management console and to users connecting to Dashboard. Then select Next. This example uses "Meraki Dashboard". 

Display-Name.png

  1. Choose AD FS 2.0 profile, then select Next. 

AD-Profile.png

  1. Skip the Configure Certificate step by selecting Next. 

  1. Check the box to Enable support for the SAML 2.0 WebSSO protocol. 

  1. In the text field, enter the Consumer URL from Dashboard under Organization > Settings > SAML Configuration. If you do not yet have a Consumer URL, first follow the steps for generating a fingerprint in the Configure Dashboard settings section. 

  1. Select Next. 
    Customer-URL.png

  1. For the Relying party trust identifier, enter "https://dashboard.meraki.com". Then select Add and Next. AD FS requires the value of this field, but does not use it. 

Trust-Identifier.png

  1. Choose default issuance authorization rules based on your preferred security behavior. This example uses Permit all users to access this relying party. Then select Next. If you choose to deny users by default, add explicit authorization rules later. This article does not cover those steps. 

Permit-All-Users.png

  1. Ensure the box to Open the Edit Claim Rules dialog... is checked, then select Close. 

edit-Claim-Rules.png

Configure the username attribute 

  1. In the Edit Claim Rules dialog, under the Issuance Transform Rules tab, select Add Rule. 

Add-Rule.png

  1. For Claim rule template, choose Send LDAP Attributes as Claims, then select Next. 

Claim-Rule.png

  1. Configure a SAML attribute for usernames: 

  1. Set the Claim rule name as "Username". 

  1. Set the Attribute store as Active Directory. 

  1. Select the LDAP Attribute that AD FS sends to Dashboard as the username. Because this appears in multiple locations and should be unique to each user, select E-Mail-Addresses or another unique characteristic. 

  1. Set the Outgoing Claim Type to "https://dashboard.meraki.com/saml/attributes/username". 

  1. Select Finish. 

SAML-Attribute.png

Configure the role attribute

  1. In the Edit Claim Rules dialog, under the Issuance Transform Rules tab, select Add Rule. 

  1. For Claim rule template, choose Send Group Membership as a Claim. 

Rule-Template.png

  1. Configure a SAML attribute for roles: 

  1. Set the Claim rule name to "Role". 

  1. Select Browse to select a group that should receive this role. 

  1. Set the Outgoing claim type to "https://dashboard.meraki.com/saml/attributes/role". 

  1. In Outgoing claim value, enter the value for a Role created in dashboard under Organization > Administrators > SAML administrator roles. The role value in the attribute must match a role in Dashboard for the user to gain access. 

  1. Select Finish. 

SAML-Attribute-2.png
SAML-Admin-Role.png

Configure Dashboard settings 

  1. In the management console, go to AD FS 2.0 > Service > Certificates. 

Certificate.png

  1. Double-click the certificate under Token-signing. 

Token-Signing.png

  1. Under Details > Thumbprint, copy this string and paste it into the X.509 cert SHA1 fingerprint field in Dashboard under Organization > Settings > SAML Configuration. 
    Thumbprint.png

  1. Replace any spaces with colons. 

  1. Use all capital letters. Otherwise, Dashboard returns the error "the Fingerprint needs to be a colon-delimited hex value". 
    Authentication.png

(Optional) To redirect users back to the AD FS login page after they log out of Dashboard: 

  1. In Dashboard, go to Organization > Settings > SAML Configuration. 

SSO-SLO.png

  1. In the SLO logout URL, enter "https://<SERVER_URL>/adfs/ls/idpinitiatedsignon.aspx". Replace "<SERVER_URL>" with the IP address or DNS name of the AD FS server. 

  1. Select Save Changes. 

Verification 

After completing configuration, users authenticating with AD FS can select "Meraki dashboard" as a site to sign into.

Sign-in.png

To confirm success, verify that a user can select Meraki dashboard and sign in without error. 

Troubleshooting 

If users cannot connect to Dashboard and receive an error, ensure that: 

  • You created claim rules for the username and role attributes as described above. 
  • You created the desired SAML administrator role in Dashboard. 
  • The user is allowed to use the application, based on any authorization rules configured in AD FS. 

For recent login attempts and resulting errors, go to Organization > Administrators > SAML administrator roles > SAML login history. 

Additional resources 

  1. Back to top
  • Was this article helpful?

Recommended articles

  1. Article type
    How-to
    Product Category
    Cloud
    Stage
    Final
  2. Tags
    1. adfs
    2. CS_12432
    3. SAML