WhimsicalWhimsical
Help Center

Loading…Open app
Whimsical statusStatusContact Us

SAML SSO with Active Directory Federation Services (ADFS)

Whimsical supports SAML-based Single Sign-On (SSO) for enterprise authentication, allowing organizations to integrate with identity providers (IdPs) like Active Directory Federation Services (ADFS). This guide provides a step-by-step walkthrough for configuring ADFS to enable SSO with Whimsical.

Note: SAML SSO is only available on our Business and Enterprise plans. You must be an admin to enable SAML SSO.

Before configuring ADFS SSO with Whimsical, ensure you have:

  • Administrator access to your ADFS instance.
  • ADFS running on Windows Server with a public HTTPS endpoint.
  • A custom domain to associate with your SSO configuration.

Step 1: Add a relying party trust in ADFSCopied!

  1. Open the ADFS Management Console.
  2. Go to Relying Party Trusts and select Add Relying Party Trust.
  3. Choose Claims Aware and click Start.
  4. Select Enter data about the relying party manually and click Next.
  5. Provide a Display Name (e.g., "Whimsical") and click Next.
  6. Select AD FS profile (SAML 2.0) and click Next.
  7. Skip the certificate setup by clicking Next.
  8. Under Configure URL, check Enable support for the SAML 2.0 WebSSO protocol.
  9. Enter the Whimsical ACS (Assertion Consumer Service) URL: https://whimsical.com/sso/saml/consume then click Next.
  10. Enter the Whimsical ACS URL here also, under Relying Party Trust Identifier
  11. Click Add, then Next.
  12. Choose an access control policy, and click Next.
  13. Click Next again to complete the setup, then Close.

Step 2: Configure claim rulesCopied!

  1. In ADFS Management Console, select the newly created Whimsical relying party trust.
  2. Click Edit Claim Issuance Policy.
  3. Click Add Rule and choose Send LDAP Attributes as Claims.
  4. Set the rule name to "LDAP to SAML Attributes".
  5. Select Active Directory as the Attribute Store.
  6. Map the following attributes:
    • E-Mail-Addresses → Name ID
    • Given-Name → FirstName
    • Surname → LastName
  7. Click Finish.
  8. Click Add Rule again, select Transform an Incoming Claim, and click Next.
  9. Set Incoming claim type to Name ID.
  10. Set Outgoing claim type to Name ID and Outgoing name ID format to Email.
  11. Click Finish and Apply the changes.

Step 3: Obtain federation metadata URLCopied!

  1. In ADFS, navigate to Service > Endpoints.
  2. Find the Federation Metadata document URL, which usually looks like: https://your-adfs-server/FederationMetadata/2007-06/FederationMetadata.xml
  3. Copy this URL as it will be required in Whimsical.

Step 4: Configure Whimsical SSO settingsCopied!

First, go to Workspace settings, which you'll find under your workspace name in the top left corner:

Then, enable SAML SSO. Once it's enabled:

  1. Enter your ADFS Metadata URL (from Step 3).
  2. Set the required attributes (NameID, FirstName, LastName) to match your ADFS claim rules.
  3. Enable SSO and test the configuration.

Step 5: Test and troubleshootCopied!

  1. If logging in with ADFS fails:
    • Check ADFS logs for errors.
    • Ensure Name ID and attribute mappings are correct.
    • Verify that the ADFS metadata URL is accessible.

If you have any trouble getting this set up, please reach out to our Support team. We're always happy to help. 😉

Written by:

  • Jack Jenkins

    Jack Jenkins

Summary

  1. SAML SSO with Active Directory Federation Services (ADFS)
  2. Step 1: Add a relying party trust in ADFS
  3. Step 2: Configure claim rules
  4. Step 3: Obtain federation metadata URL
  5. Step 4: Configure Whimsical SSO settings
  6. Step 5: Test and troubleshoot