Summary

This document will guide you through the steps to make sure ADFS can serve relying parties, using OpenIDConnect to fetch claims from ADFS, when PhenixID acts as an external Claims Provider in ADFS.

System Requirements

• PhenixID Authentication Services 2.6 or higher
• PhenixID Authentication Services setup as a SAML Identity Provider. NameID to be sent should be in format “domain\sAMAccountName”
• PhenixID Authentication Services SAML IdP added as a Claims Provider in ADFS
• Connectivity (ie https://<adfs>/adfs/ls/idpinitiatedsignon.aspx) between PAS and ADFS setup.
• A relying party, using OpenIDConnect as integration method, setup in ADFS. RP should be able to use PhenixID Authentication Services SAML IdP as Claims Provider

Instruction

Run powershell command

1. Open Powershell as administrator on the ADFS server
2. Run command. Replace <my_identifier> with the identifier of your PhenixID Claims Provider:
   set-adfsclaimsprovidertrust -targetidentifier <my_identifier>  -AnchorClaimType  http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname

   Example:
   set-adfsclaimsprovidertrust -targetidentifier http://mfa.phenixid.com/saml/idp -AnchorClaimType  http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname

Test

1. Open a web browser. Browse to the openidconnect relying party
2. Login
3. You should now be logged in to the OIDC RP