This guide covers the configuration of a Relying Party Trust in AD FS and the corresponding configuration in ResourceXpress. It does not cover the installation or initial configuration of ADFS.
If you intend to restrict access to ResourceXpress to a specific set of users it is recommended you create a relevant Active Directory security group before proceeding with the AD FS configuration.
Download the ResourceXpress MetaData file
Before downloading the Metadata file ensure you are accessing ResourceXpress via a routable URL. Do not download the file if you are browsing the application from its host server using “localhost”.
If your end-users will be accessing ResourceXpress via a public/external URL ensure you generate the file when browsing this URL not the internal FQDN.
Login to ResourceXpress as an application administrator
Navigate to the SSO Settings tab found on the System Settings page, under the Administration Settings menu header, download the SPMetadata.xml.
Copy the SPMetadata.xml file to the AD FS server
Enable Forms Authentication in AD FS
Open the AD FS Management utility on your AD FS Server
In the left pane, right-click Authentication Methods and select Edit Primary Authentication Methods…
Ensure Forms Authentication is selected
Create a Relying Party Trust in AD FS
Initial Configuration
Open the AD FS Management utility on your AD FS Server
In the left pane, right-click Relying Party Trusts and select Add Relying Party Trust…
On the initial screen select the Claims aware option then click start
On the Select Data Source screen select the option Import data about the relying party from a file then click Browse…
Locate the SP Metadata file downloaded from ResourceXpress and click Next >
Enter a suitable display name e.g. ResourceXpress and add optional Notes regarding the application then click Next >
On the Choose Access Control Policy page select the option Permit specific group then click the <parameter> option in the Policy window
In the pop-up Select Groups window click Add… then browse for and add the security groups that will have access to ResourceXpress
Once added click Next > to proceed to the Ready to Add Trust window and click Next > again to save the configuration. You will see the new configuration in the Relying Party Trusts main window
Configuring Attributes
Right-click the newly created configuration and select Edit Claim Issuance Policy… then click Add Rule… in the pop-up window
In the Choose Rule Type window drop down the option Claim rule template: and select Send LDAP Attributes as Claims then click Next >
Give the rule a suitable name and select Active Directory as the Attribute store:
The following tables list the three required claims as well as two optional claims for RFID and Access Code. The optional claims should be configured if you intend to make authenticated instant bookings on Room Screen devices and/or you will not be enabling SSO for the mobile Kiosk/Maps features.
The attributes used for the optional claims can be any AD attribute however, the value for each user must be unique.
Required Claims
Outgoing Claim Name | LDAP Attribute |
|---|---|
E-Mail-Address | |
firstname | Given-Name |
lastname | Surname |
Optional Claims
In addition to synchronising users details, it is also possible to retrieve other attributes that can be used to populate Access Code, RFID and other values in the ResourceXpress local user's database.
To configure this you will need to add more Claims, see the table below for optional Claims.
Claim Name | Information | LDAP Attribute |
|---|---|---|
rfid | The RFID value as read by the ResourceXpress system, used for screen authentication. | custom attribute |
accesscode | The users Access Code/PIN, used for screen authentication. | custom attribute |
defaultlocation | The ID number for the Location that the user will have default access to. This requires a single Location ID value. To get the Location ID number, navigate to the location edit screen. Administration Settings → System Settings → Locations Then select the Edit Button ( | custom attribute |
allowedlocation | A comma separated list of Location ID numbers that the user has access to. If more than 1 location is required, separate the ID values with a comma ( , ). To get the location ID number, navigate to the location edit screen. Administration Settings → System Settings → Locations Then select the Edit Button ( | custom attribute |
dateformat | The date format for the user.
| custom attribute |
roles | A comma separated list of Role ID numbers. If more than 1 role is required, separate the ID values with a comma ( , ). The default role ID values are as below
To get the Role ID number for any custom Roles, navigate to the Role edit screen. User Management → Roles Then select the Edit Button ( | custom attribute |
) for the correct location.New in v2021.5 HF1
If no valid optional claim mappings exist, or the value is blank, ResourceXpress will fall back and use the value that has been entered manually via the RX Admin Dashboard
To overwrite the database with a blank value, use either a zero (0) or a hyphen (-) for the Attribute.
If the attribute contains any value other than a zero (0) or a hyphen (-), this value will be written to the user account the next time the user signs in via SSO.
Once you have configured the claims click OK and Apply
You have successfully configured AD FS
Configuring ResourceXpress
Obtaining the IDP MetaData file
Once you have configured AD FS for SSO you will need to download the IDP MetaData file for use in ResourceXpress. To obtain this file navigate to the below URL replacing <ADFS-ServerName> with the FQDN of your AD FS server.
https://<ADFS-ServerName>/FederationMetadata/2007-06/FederationMetadata.xml
Download the file to a suitable location.
Application Configuration
Before configuring and saving the below configuration please ensure you have a valid local administrator account configured in ResourceXpress.
It is important that this account has the same values for First Name, Last Name and Email ID matched to the respective LDAP attributes.
Failure to have a locally configured administrator account before saving the SSO settings could result in you being locked out of the application.
Log in to ResourceXpress with a local administrator account and navigate to Administration Settings - System Settings then select the SSO Settings tab
Click Choose file in the IDP Metadata field, browse to the file previously downloaded from AD FS then click Upload
The URL and Authenticating Authority fields will be auto-populated with the required values
Select the options to Auto create user records from SSO and Sync user details from SSO
Click Save
You have successfully configured SSO via AD FS for ResourceXpress. When a new user navigates to the application URL they will be prompted for their SSO credential, after successfully signing in a new local user account will be created with the User role assigned by default.
