Configure ADFS

This document outlines the steps for configuring Active Directory Federation Services (ADFS) to facilitate Single Sign-On (SSO) with Cinchy.

Certainly, presenting the information in a table can help make it easier to understand. Here's how you can structure it:

Before You Begin

Before starting with the ADFS configuration, make sure to have following information:

Information RequiredDescriptionReference

Cinchy SSO URL

The URL of your Cinchy SSO instance


Cinchy URL

The URL of your main Cinchy instance


Cinchy SSO Installation Path

Directory where CinchySSO files are located


ADFS Server

The URL of your ADFS server


Having these details readily available will streamline the ADFS configuration process.

Configuration Steps in ADFS

  1. Navigate to AD FS Management on your ADFS server.

  2. Right-click on Relying Party Trusts and choose Add Relying Party Trust to open the Add Relying Party Trust Wizard.

  3. In the wizard, select Claims Aware > Start > Select Data Source.

  4. Select Enter Data About the Relying Part Manually > Next.

  5. Fill in a Display Name under Specify Display Name.

  6. Skip certificate configuration in Configure Certificates.

  7. In Configure URL, select Enable support for the SAML 2.0 SSO Web SSO protocol.

  8. Input your login URL as follows:

  9. Under Configure Identifiers, add an Identifier and press Next to complete the setup.

Set up Claim Issuance Policy

  1. Right-click on the newly created Relying Party Trust (located by its Display Name) and select Edit Claim Issuance Policy.

  2. Select Add Rule > Claim Rule > Send LDAP Attributes as Claims.

  3. Input a Claim Rule Name.

  4. In the Attribute Store, select Active Directory. Map the LDAP attributes to the corresponding outgoing claim types as shown in the table below:

LDAP AttributeOutgoing Claim TypeComments


Name ID



Type sub manually to avoid auto complete


Given Name

Required for Auto User Creation



Required for Auto User Creation


E-Mail Address

Required for Auto User Creation



Required for Auto User Creation

  1. Select Finish.

  2. Select Edit Rule > View Rule Language. Copy the Claim URLs for later use in configuring your Cinchy appsettings.json. It should look like the following:

    c:[Type == "", Issuer == "AD AUTHORITY"]
      => issue(store = "Active Directory",
              types = ("",
              query = ";userPrincipalName,sAMAccountName,givenName,sn,mail,memberOf;{0}",
              param = c.Value);
  3. Press OK to confirm and save.

Configuration for Cinchy

Note: Please ensure that the configurations below are case-sensitive and align exactly with those in your SAML IdP setup.

Initial setup

  1. Retrieve and save the Federation Metadata XML file from the following location: https://{your.ADFS.server}/FederationMetadata/2007-06/FederationMetadata.xml.

  2. If needed, use IIS Manager to establish an HTTPS connection for the Cinchy website.

  3. Also establish an HTTPS connection for the SSO site. Make sure the port number aligns with the one specified in the login URL.

Configuration for appsettings.json

App Settings Section

AttributeValue or Description


URL of the user login redirect https://{your.cinchysso.url}/Account/LoginRedirect


URL of the user post-logout redirect https://{your.cinchy.url}


Path to Cinchy SSO certificate {Path/to/CinchySSO}\cinchyidentitysrv.pfx


Relying Party Identifier from earlier-configured Relying Party Trust


Entity ID for SAML IdP, found in FederationMetadata.xml http://{your.AD.server}/adfs/services/trust


Location of saved FederationMetadata.xml from Initial setup


URL path in Domain Controller's in-service endpoints https://{your.AD.server}/Saml2/Acs




Maximum header size in bytes; adjustable if default is insufficient


Should be equal to or larger than MaxRequestHeadersTotalSize


Maximum request body size in bytes (use -1 for default; usually no need to change)

External identity claim section

You will need to refer to the Rule Language URLs you copied from the ADFS Configuration. Replace the placeholders below with your own URLs:

  "AppSettings": {
    // Replace placeholders below with URLS
  "ExternalIdentityClaimSection": {
    "FirstName": {
      "ExternalClaimName": ""
    "LastName": {
      "ExternalClaimName": ""
    "Email": {
      "ExternalClaimName": ""
    "MemberOf": {
      "ExternalClaimName": ""

Edit web.config

Insert the following lines within the <appSettings> section of your web.config file. Make sure to replace the {your.cinchy.url} and {your.cinchysso.url} with your Cinchy and Cinchy SSO values.

  <!-- Replace placeholders below with URLS -->
  <add key="UseHttps" value="true" />
  <add key="StsAuthorityUri" value="https://{your.cinchy.url}" />
  <add key="StsRedirectUri" value="https://{your.cinchysso.url}/Account/LoginRedirect" />
  <!--  -->

Last updated