AD Setup

Follow the below instructions to integrate your on premises Smartsign server with Active Directory.

Server requirements

• Smartsign Server version 10.24 or higher.
• Server must be configured to use SSL/TLS (https).

Licensing

Using Active Directory (AD) integration requires a valid Support- and Upgrades agreement (SMSUP) for all licenses. 

Setup overview

1. Create and configure an application group in Active Directy Federation Services (ADFS)
2. Map AD groups to relevant sites and user profiles in Smartsign
3. Configure and Enable AD authentication in Smartsign Server (Smartsign Identity)
4. Configure auto-provisioning for users from your AD (Optional)
5. Map AAD groups to Smartsign groups to control resource permissions (screens, media etc) from AD (Optional)

tip

• If any setting or button referenced is missing after you enable AD, please refresh your browser window.

Configure Active Directory Federation Services (ADFS)

Create an application group

In Server Manager, navigate to AD FS Management and create a new application group:

1. In the console tree, select Application Groups and choose Add Application Group from the Actions list.
2. On the Welcome screen of the wizard, input a Name and choose the Server application accessing a web API template.
   
3. On the Server application screen:
   

• Give the Server application a Name.
• Take note of the Client Identifier. You will need it later.
• Specify Redirect URIs. This should be the URL to your Smartsign server followed by the below suffixes:
  • /id/signin-adfs (example: "https://smartsign.example.com/id/signin-adfs")
  • /id/signout-adfs
  • /id/signout-callback-adfs

4. On the Configure Application Credentials screen, select *Generate a shared secret".
   Take note of the Secret, you will need it later.
   
5. On the Configure Web API screen:
   

• Give the WEB API a Name
• Add the Client Identifier and Redirect URIs to the list of Identifiers.

6. On the Apply Access Control Policy screen, set an appropriate Access Control Policy for the Application Group.
   
7. On the Configure Application Permissions screen, Select the following in Permitted scopes:
   

• allatclaims
• email
• openid
• profile

8. Finish the Add Application Group Wizard

Add Issuance Transform Rules

In Server Manager, navigate to AD FS Management and edit the created application group:

1. In the console tree, select Application Groups.
2. In the Application Groups list, right-click the created application group and select Properties.
3. In the Applications section, choose the Web API and select Edit.
4. Navigate to the Issuance Transform Rules tab

• Add a rule:
  • On the Choose Rule Type screen, select Send LDAP Attributes as Claims.
  • On the Configure Claim Rule screen:
    
  • Give the rule a Claim rule name
  • Select Attribute store: Active Directory
  • Add the following mappings:
  • Display-Name --> Name
  • E-Mail-Addresses --> E-Mail Address
  • Token-Groups - Unqualified Names --> Groups
    tip

    You can decide if you want to use group names or group SIDs to map groups in Smartsign.
    Using group names is intuitive, but may be limiting in a more complex environment.
    To use group SIDs, replace the above group mapping with this: Token-Groups as SIDs --> Groups

  • Select Finish
• Add a rule:
  • On the Choose Rule Type screen, select Send Claims Using a Custom Rule.
  • On the Configure Claim Rule screen:
    
  • Give the rule a Claim rule name
  • Input the following text to the Custom rule:
    => issue(Type = "email_verified", Value = "true");
  • Select Finish
• Select OK to finish

Enable Active Directory authentication for Smartsign Server

1. On the server, find Smartsign Server Installer - Advanced Settings in the start menu and launch it
2. Input the following configurations:
   • ADFS Application Client Identifier
   • Application Client Secret
   • ADFS Service URL (the service url of your ADFS server)
3. Save the settings
4. Smartsign needs to be restarted for the settings to apply. You can do so directly from the Server Installer by clicking Restart Smartsign
5. Wait until Smartsign is up and running again
6. Login to Smartsign Publisher with an Admin account
7. Open Management → System → System settings
8. Select the Active Directory settings category
9. Configure the settings as follows:

   Setting	Value	Description
   Enable AD	True/False	Enables or disables Active Directory integration
   Self registration	True/False	True: Authenticated users are automatically registered and linked in Smartsign (recommended) False: Users must manually link an existing Smartsign user to their Azure AD credential
   Sync sites from identity provider	True/False	True: Site access will be synchronized with AD every login (recommended) False: Site access will only be synchronized the first time a new user signs in (at self registration)

10. Click Save, AD integration is now enabled and will appear as an option on the login page.
    
11. Done, Active Directory authentication is now enabled

Configure access for auto-provisioning (optional, recommended)

1. If you want to use auto-provisioning, we now need to determine which users should be allowed to sign in using AD and have their users created automatically.
   If you haven't already, please prepare the necessary AD security groups in accordance with the Planning section.
   For this example we will use the following example groups:

   Group name
   Smartsign-Site-MyCompany
   Smartsign-Permissions-Publisher
   Smartsign-Permissions-SiteAdmin

2. As an Admin, in Publisher, go to Management → Sites and view the site that you wish to configure.

3. In AdfsGroupClaim, provide the name of the AD group that should give access to the site (or group SID for alternative configuration)
   

4. Go to Management → Users → User profiles and view each user profile that you want to use with AD.
   Connect it to the relevant AD group by providing the name of each AD group in AdfsGroupClaim (or group SID for alternative configuration).
   Then click Save.
   
   

5. Users with the relevant groups should now be able to login using their AD credentials.

6. Done!

Manage resource access using Active Directory (optional)

Access Groups are used to control access to resources, such as screens, media library folders etc, for all non-admin users.
These can either be managed directly in Smartsign or mapped to Active Directory (AD) groups to control resource access from AD.

1. Create or identify the AD security groups to use for access control in Smartsign.
2. Find and note the name for each group (or group SID for alternative configuration)
3. Create the corresponding groups in Smartsign and input the AD Group name to connect it to the AD group.
   
4. Assign which resources the group should provide access to.
5. Done! Users will be automatically added/removed from the groups each login, based on the AD group memberships.