1. Ensure AD FS is installed on your server.
2. Open Server Manager and select Tools >> AD FS Management.
3. Open the AD FS tree to Trust Relationships >> Relying Party Trusts.
4. In the action pane, click Add Relying Party Trust.
5. Click Start.
6. Select Import data about the relying party published online or on a local network and click Next.
7. Enter https://w3.cezanneondemand.com/CezanneOnDemand/-/{company-identifier}/Saml/metadata into the Federation metadata address field (where {company-identifier} should be replaced to match your company's Primary URL).
8. Click Next.
9. Enter a display name (e.g. “Cezanne”) in the Display Name field and click Next.
10. If prompted, select I do not want to configure multi-factor authentication… at this time and click Next.
11. Select Permit all users to access this relying party, click Next and Next again.
12. Select Open the edit claim rules dialog… when the wizard closes and click Close.
13. Continue to the Configuring AD FS Issuance Transformation Rules section below.

1. Backup your AD server.
2. Install AD FS.
3. Open Server Manager and select Tools >> AD FS Management.
4. Open the AD FS tree to Trust Relationships >> Relying Party Trusts.
5. In the action pane, click Add Relying Party Trust.
6. Click Start.
7. Select Enter data about a relying party manually and click Next.
8. Enter a display name (e.g. “Cezanne”) and click Next.
9. Select AD FS Profile and click Next.
10. Click Next to skip the optional certificate configuration step.
11. Select Enable support for SAML 2.0 WebSSO protocol.
12. In the Relying Party SAML 2.0 SSO Service URL box, enter https://w3.cezanneondemand.com/CezanneOnDemand/-/{company-identifier}/Saml/samlp and click Next (where {company-identifier} should be replaced to match your company's Primary URL).
13. Add https://w3.cezanneondemand.com/CezanneOnDemand/  to the relying party trust identifiers list and click Next.
14. If prompted, select I do not want to configure multi-factor authentication… at this time and click Next.
15. Select Permit all users to access this relying party, click Next and Next again.
16. Select Open the edit claim rules dialog… when the wizard closes and click Close.
17. Continue to the Configuring AD FS Issuance Transformation Rules section below.

1. Add a new custom rule to the Issuance Transformation Rules tab.
2. Click Add Rule.
3. Use the Send LDAP Attributes as Claims rule template.
4. Click Next.
5. Enter a rule name (e.g. “NameID Rule”) in the Claim rule name field.
6. Select the Active Directory attribute store.
7. Add a new LDAP attribute mapping from LDAP Attribute ‘User-Principal-Name’ to Outgoing Claim Type ‘Name ID’
8. Click Finish.

If you don’t want users that are already authenticated on you domain to have to enter their username and password when they access Cezanne, you need to ensure that Integrated Windows Authentication (IWA) is enabled for the adfs/ls web application in IIS.

1. Open Internet Information Services (IIS) Manager.
2. Navigate to Sites >> Default Web Site >> adfs >> ls.
3. Double click on Authentication in the IIS section of the Features View.
4. If Windows Authentication is disabled, right click on it and select Enable.
5. If your company uses reverse proxies, virtual private networks or browsers other than Internet Explorer, you must also disable Extended Protection for Windows Authentication:
   1. Still in the Authentication view, right click on Windows Authentication and select Advanced Settings.
   2. Ensure that Extended Protection is set to Off.
   3. Click OK.
6. Open the Windows Command Prompt as an administrator and run the following commands to restart IIS and AD FS:
   1. iisreset
   2. net stop "AD FS 2.0 Windows Service"
   3. net start "AD FS 2.0 Windows Service" 

In ADFS 3.0 it is required to ensure that only windows authentication is enabled to prevent browsers prompting for credentials. To do this:

1. Open up the ADFS Management Console on your ADFS server
2. Select the “Authentication Policies ” and then “edit” in the Primary Authentication Global Settings.

3. Make sure that windows authentication is the only option checked and apply.

There are two ways to associate your users' AD identities with their Cezanne user accounts. You can use the User Settings screen to associate individual users or the SAML 2.0 Users Data Import to associate users in bulk.

Using the User Settings Screen

1. Navigate to: System Setup >> Manage Users >> User Settings.
2. Search for the user you wish to update.
3. Select the Single Sign-On tab.
4. In the SAML 2.0 Identifiers section, click Add New.
5. In the Identity Provider column select AD FS and in the User Identifier column enter the user's AD username.
6. Click Save.

Try disabling Extended Protection for Windows Authentication on the adfs/ls web application (as described in ‘Configuring Integrated Windows Authentication’). Unfortunately Extended Protection cannot be used with reverse proxies, virtual private networks and browsers other than Internet Explorer.

If you are using Internet Explorer, check that Windows Authentication is enabled in your local computer’s Internet Settings:

1. From the Windows Control Panel, Open Internet Options from the Windows Control Panel.
2. Select the Advanced tab.
3. Scroll down to the Security section in the settings tree and ensure Enable Integrated Windows Authentication is ticked.
4. Click OK.
5. If the setting wasn’t already enabled, restart your computer so that the change can take effect.

If you are using Firefox, check that Firefox is configured to trust your domain:

1. Enter ‘about:config’ in the Firefox URL bar and press enter.
2. If prompted, click I’ll be careful, I promise!
3. Type ‘ntlm-auth.trusted-uris’ into the search bar.
4. Double click network.automatic-ntlm-auth.trusted-uris.
5. If not already specified, enter the fully qualified name of your AD FS server (e.g. ‘adfs.mycompany.local’).
6. Click OK and close the configuration tab.

If the problem occurs in Chrome and Firefox, but not Internet Explorer, try disabling the ‘Negotiate’ Windows Authentication protocol:

1. Open Internet Information Services (IIS) Manager on your AD FS server.
2. Navigate to Sites >> Default Web Site >> adfs >> ls.
3. Double click on Authentication in the IIS section of the Features View.
4. Right click Windows Authentication and select Providers.
5. Select Negotiate and click Remove. You should be left with just NTLM.
6. Click OK.
7. Open the Windows Command Prompt as an administrator and run the following commands to restart IIS and AD FS:

iisreset

net stop "AD FS 2.0 Windows Service"

net start "AD FS 2.0 Windows Service"

8. Try logging in through Chrome or Firefox again.

If you are able to log in successfully then your browser was previously attempting to authenticate using the Negotiate protocol and failing. The Negotiate protocol is considered more secure than NTLM but is less well supported by non-Microsoft browsers. If you wish to re-enable the Negotiate protocol, you may be able to work around some of these problems using browser, operating system and network specific registry settings that are beyond the scope of this document.

If the above instructions still do not work:

1. In Windows, Click Start >> Control Panel >> Internet Options >> Security tab
2. Select Local intranet and click Sites.

3. Select Advanced.

4. Add your ADFS server into the Websites list, e.g. https://adfs-server.example.com (You should check first with your system administrator before adding this).