Configure SAML with Active Directory Federation Services as identity provider

An Organization administrator role is required. For information, see User roles.

Before you begin, read Configure SSO with an Identity provider connection.

Jump to:

Get the Identity Provider data from Nintex Workflow
  1. In the Identity provider connections page in Nintex Workflow, click Add connection.
  2. In the Add connection panel, select ADFS as the identity provider.

    3. Additional fields appear for the following:

    • Relying party trust identifiers
    • Callback Url
    • Mapping of LDAP attributes to outgoing claim types

    Note: You will later need to copy and insert these values in specific fields in Active Directory Federation Services.

  3. Keep your Nintex Workflow browser open and go to Active Directory Federation Services.

Add Nintex Workflow to Active Directory Federation Services
  1. Sign in to Active Directory Federation Services as an administrator.
  2. Add Nintex Workflow as an application or service provider for SAML.
  3. Copy the Relying party trust identifiers and Callback URL values, and the attribute statements from Nintex Workflow, and then paste them in the corresponding fields in Active Directory Federation Services. 
    1. In the Configure URL tab of the Add Relying Trust Wizard, paste the Callback URL value in the Relying party SAML 2.0 SSO service URL field.
    2. In the Configure Identifiers tab of the Add Relying Trust Wizard, paste the Relying party trust identifiers value from Nintex Workflow.

      3. Nintex Workflow SAML configuration in Microsoft Active Directory Federation Services

    3. In the Configure Claim Rule page of the Add Transform Claim Rule Wizard, use the name and values from the Attribute table in Nintex Workflow.

      4. Caution: Select the values from the drop-down list and do not enter values manually.

      Microsoft Active Directory Federation Services in Nintex Workflow

  4. Retrieve the SAML metadata URL or file. Copy the metadata URL, and paste it in the URL field of Nintex Workflow's setup wizard.

Caution: After adding Nintex Workflow as a SAML application to your identity provider, make sure that users exist in the directory of your identity provider. Depending on the identity provider, an empty directory may cause SAML configuration to fail. For information on how to manage user accounts, refer to your identity provider's documentation.

    For the SAML configuration steps in Active Directory Federation Services, see the Auth0 documentation.

Complete the SAML configuration
Note: 
  • Make sure that you have provided the metadata URL or file in Nintex Workflow's setup wizard.
  • Make sure that your domain is successfully verified.

Follow these steps to complete the SAML configuration:

  1. In the Connect page of the setup wizard in Nintex Workflow, click Connect.

    2. Note: The Connect button is enabled only when your domain is successfully verified and you have provided the metadata URL or file.

    After connecting, your SAML configurations are checked. If successful, the setup wizard goes to the final page with the following information:

    Information Description
    Expiry date of certificate Date when your certificate expires.
    Recipient email address of the reminder for certificate expiry

    When your certificate is expiring soon, a reminder email will be sent to the recipient email address.

    Caution: You must renew the certificate before the expiry date.
    One-Time Password (OTP) URL

    The One-Time Password (OTP) URL is used for troubleshooting purposes when configuration fails and you are locked out of your tenant.

    Follow these steps to access your tenant when you cannot sign in due to a failed configuration of SAML:

    1. To copy the One-time password URL, click (Copy) next to the One-time password URL field.
    2. Open a new tab on your web browser, paste the copied URL and press ENTER.
    3. Enter your email address, and click Submit.

      4. For verification, a one-time password is sent to your email address. The one-time password expires after five minutes.

    4. Enter the one-time password you received, and click Sign in.

      5. You can access your Nintex Workflow tenant and resume configuring your identity provider connection.
  1. Click Done.

    The Identity provider connection section now lists information about your SAML configuration such as provider, domain, person who completed the configuration, and the date of configuration.

Test your SAML connection

  1. Sign in to your Nintex Workflow tenant.
  2. Click Sign in or press ENTER.

    3. You are taken to the login page of Active Directory Federation Services.

  3. In Active Directory Federation Services's login page, type your credentials, and then submit.

    4. If the SAML configuration is successful, you are granted access to the Nintex Workflow tenant.

Page Section User interface element

Description
Identity Provider Choose Identity Provider Identity provider

Displays the list of identity providers you can use for your tenant's identity federation.

  Service Provider data

 

(Appears after you select an identity provider)

In the context of our SAML configuration, the service provider is Nintex Workflow. Depending on the identity provider you choose, the SAML terminologies displayed in this section correspond with what your identity provider uses.

  Generic term Terminologies used in identity providers
Okta PingOne OneLogin Google Suite Active Directory Federation Services

Azure Active Directory

 
Entity ID A globally unique identifier of an entity, which in our case is the Nintex Workflow tenant to be configured with SAML. Audience URI (SP Entity ID) Entity ID Audience Entity ID Relying party trust identifier Identifier (Entity ID)
ACS URL or Assertion Consumer Service URL Single sign on URL ACS URLS ACS (Consumer) URL ACS URL Relying party SAML 2.0 SSO service URL Reply URL (Assertion Consumer Service URL)
Metadata An XML document that contains information about a SAML deployment. URL A link is provided to retrieve the URL.

IDP Metadata URL

A downloadable metadata file is also available.

Issuer URL A downloadable metadata file is provided. Federation Service identifier App Federation Metadata Url
   

Attributes

Set of identity data about a user. In configuring SAML in Nintex Workflow, only three attributes are requested from the identity provider:

  • First name
  • Last name
  • Email
    (Copy) Click to copy the values in the fields.
Connect
  URL

Location of the SAML metadata An XML document that contains information about a SAML deployment..
    Upload metadata The SAML metadata file.
Complete  

<Date>

(Only displayed for SAML)

Expiry date of the certificate.
    <Email address>

(Only displayed for SAML)

Email address to receive reminder when certificate is soon to expire.
  One-Time Password (OTP) URL <URL>

The One-Time Password (OTP) URL is used for troubleshooting purposes when configuration fails and you are locked out of your tenant.

Follow these steps to access your tenant when you cannot sign in due to a failed configuration of SAML:

  1. To copy the One-time password URL, click (Copy) next to the One-time password URL field.
  2. Open a new tab on your web browser, paste the copied URL and press ENTER.
  3. Enter your email address, and click Submit.

    4. For verification, a one-time password is sent to your email address. The one-time password expires after five minutes.

  4. Enter the one-time password you received, and click Sign in.

    5. You can access your Nintex Workflow tenant and resume configuring your identity provider connection.