Admin Single Sign-On (SSO) Setup: Integrating Microsoft ADFS with Vome

Admin Single Sign-On (SSO) Setup: Integrating Microsoft ADFS with Vome

Overview

This article explains how to integrate Microsoft Active Directory Federation Services (ADFS) with Vome using SAML 2.0 authentication. Once configured, your administrators can securely log in to Vome using their existing organizational credentials managed by your ADFS server.

1. Understanding SAML SSO

SAML (Security Assertion Markup Language) enables single sign-on (SSO) by securely exchanging authentication data between:

  • Identity Provider (IdP): Your Microsoft ADFS server
  • Service Provider (SP): Vome platform
  • User: The administrator logging in

Authentication Flow Summary

  1. Admin clicks "Login with SSO" in Vome
  2. Vome redirects the admin to your ADFS login page
  3. Admin enters their organizational credentials
  4. ADFS validates credentials and generates a signed SAML assertion
  5. Assertion is sent back to Vome
  6. Vome validates the signature and grants access
Info
Note: ADFS integration supports authentication only (no user syncing). Each admin must already exist in Vome.

2. Prerequisites

Before beginning:

On ADFS

  • Administrative access
  • Ability to create Relying Party Trusts
  • HTTPS access to your ADFS server
  • Token-signing certificate available

On Vome

  • Using the Ultimate plan

3. ADFS Configuration Steps

Step 1. Add a New Relying Party Trust

  1. Open ADFS Management Console
  2. Go to Trust Relationships > Relying Party Trusts > Add Relying Party Trust
  3. Choose Claims Aware, click Start, then select "Enter data manually."

Step 2. Configure URLs and Identifiers

  • Enable SAML 2.0 WebSSO protocol
  • Use the Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) provided by Vome from your Settings page > SSO (Single Sign-On) > ADFS

Step 3. Add Claim Rules

Create two rules, in this order.

Rule 1: Send LDAP Attributes as Claims

  • Attribute store: Active Directory
  • LDAP Attribute: E-Mail-Addresses
  • Outgoing Claim Type: E-Mail Address

This rule has to produce the E-Mail Address claim, because that is what Rule 2 transforms.

Rule 2: Transform Email to NameID

  • Incoming claim: E-Mail Address
  • Outgoing claim: Name ID
  • Format: Email
  • Pass through all values

Step 4. Export Required Files

  1. Federation Metadata XML
    • URL example: https://adfs.yourcompany.com/FederationMetadata/2007-06/FederationMetadata.xml
    • Download and save
  2. Token-Signing Certificate
    • Export as Base-64 encoded X.509 (.CER) file

4. Configure Vome

  1. Go to Settings > Single Sign-On (SSO)
  2. Select Microsoft ADFS
  3. Upload:
    • Federation Metadata XML
    • Token-Signing Certificate (.CER)
  4. Ensure "Sign SAML response and assertion" is enabled in ADFS
  5. Click Verify Configuration

If successful: "SSO configuration verified successfully!"
If error: Check Entity ID, ACS URL, and certificate validity.

5. Testing and Enforcement

Test Your SSO Connection

  • Click Test SSO
  • Authenticate via your ADFS login page
  • You will be redirected back to Vome upon success

Enforce SSO (Optional)

  • Toggle Require SSO for all users
  • Use Manage excluded users to keep a backup way in. This is strongly recommended: without an exclusion, an outage on your ADFS server locks you out of Vome as well.