How to set up AD FS SAML SSO: Relying party trust, claims rules and metadata

Active Directory Federation Services (AD FS) can be connected to WorkOS through SAML by having an administrator create a claims-aware relying party trust from WorkOS service provider metadata, configure LDAP-based claims for required user attributes, and provide AD FS federation metadata back to WorkOS. The setup depends on correctly matching the SAML Assertion Consumer Service URL, mapping email, first name, surname, and especially User-Principal-Name to the expected outgoing claim types, as UPN provides the required identity-provider identifier. Group claims are optional for authentication but necessary for role assignment, with roles determined by mapped group IDs and refreshed when users sign in; Directory Sync may be preferable for more current group-based roles. Common failures include incorrect ACS endpoints, inaccessible or improperly addressed metadata URLs, missing UPN claims, incomplete attribute mappings, and absent or mismatched group claims. Administrators should use a fully qualified domain name for AD FS metadata, test with a user in a mapped group, and may configure connections through the WorkOS Admin Portal, which provides time-limited setup links for IT contacts.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.