• Installation Type – Select Role-based or feature-based installation.
• Server Selection – Select the intended server.
• Server Roles – Enable Active Directory Federation Services.
• Features – Click Next to continue with modifications.

• Connect to ADFS – Specify an account with Active Directory domain administrator privileges to perform the federation service configuration.
• Specify Service Properties – Configure the following settings:
  

  Setting	Description
  SSL certificate	Select a certificate for AD FS configuration.
  Federation Service Name	Provide the AD FS service’s endpoint. For example, adfs.airwlab.com.
  Federation Service Display Name	Provide the display name. For example, AIRWLAB Federation Services.

• Specify Service Account – Select an existing domain user account  for the AD FS service account, or create a new one.  Creating a new account requires appropriate access permissions.
• Specify Database – Choose between using a Windows Internal Database or providing a SQL Server database.  If prompted to overwrite an existing AD FS configuration database, overwrite before continuing.

1. Login to your Identity Manager tenant with an administrator account.
2. Navigate to Identity & Access Management > Identity Providers > Add Identity Provider > Create Third Party IDP.
   • Identity Provider Name – Use any name as desired. For example, ADFS.
   • SAML Metadata – Copy and paste the previously downloaded FederationMetadata.xml file into the field, and click Process IdP Metadata.  The Name ID format mappings use the imported xml to establish. This creates trust with AD FS as an Identity Provider for VMware Identity Manager.
   • Just-in-Time User Provisioning – Leave this setting disabled, because this guide does not cover this implementation.
   • Users – Select the Directory that this Identity Provider applies to. For example, select the synced corp.local directory, which contains the corp.local domain users.
   • Network – If setup, choose the network range this Identity Provider applies to. Use the default value, ALL RANGES,  to apply the identity provider across all networks.
   • Authentication Methods – Choose the method used to authenticate users processed by this identity provider. For example, review the table below:
     

     Authentication Methods	SAML Context
     SAML Password	urn:oasis:names:tc:SAML:2.0:ac:classes:Password
     SAML Kerberos	urn:oasis:names:tc:SAML:2.0:ac:classes:Password
     Windows Auth	urn:federation:authentication:windows

   • Single Sign-Out Configuration – Allow users to end their IdP session when they sign out from the Workspace ONE apps portal.
   • Service Provider Metadata – Open a URL that contains the metadata required to establish trust between AD FS and the VMware Identity Manager tenant.
3. Click Save.

• Select Data Source – Import the Metadata file using the URL or the file. For example, provide the Service Provider Metadata URL from the previous step.
• Multi-Factor Authentication – Configuring Multi-Factor Authentication (MFA) is beyond the scope of these instructions, so leave this option disabled.
• Issuance Authorization Rules – Permit all users to access this relying party.
• Ready to Add Trust – Review the settings, and click Next to add the trust.

Add the Get Attributes Email Address Rule

1. Click Add Rule.
2. Select Send LDAP Attributes as Claims, and click Next.
   • Claim Rule Name – Get Attributes Email Address
   • Attribute Store – Active Directory
   • LDAP Attribute – E-Mail-Address
   • Outgoing Claim Type – E-Mail Address
3. Click Finish.

Add the Transform Email Address Rule

1. Click Add Rule.
2. Select Send Claims using a Custom Rule, and click Next.
   • Claim Rule Name – Transform Email Address
   • Custom Rule – Enter the below text and change the spnamequalifier to your VMware Identity Manager URL:c:[Type == “http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress”] => issue(Type = “http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier”, Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties[“http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format”] = “urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress”, Properties[“http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier“] = “yourtenant.vmwareidentity.com“);
3. Click Finish.

Handle Local Users Authenticating into the Workspace ONE Portal

1. Under Policy Rules, click the + button.
2. Configure the specified settings:
   • Network Range – ALL RANGES.
   • Device Types – All Device Types
   • Authentication Methods – Password (Local Directory)–Select Authentication Method.
3. Click OK.
4. Use the handle on the left of the newly created policy rule to drag it to the top of the current Policy Rules list.

Handle Domain Users Authenticating into the Workspace ONE Portal through AD FS

1. Under Policy Rules, click the + button.
2. Configure the specified settings:
   • Network Range – ALL RANGES.
   • Device Types – All Device Types.
   • User Groups – Click Edit Groups and select the user group for your domain users.
   • Authentication Methods – Select SAML Kerberos, Select Windows Auth, Click + fallback method(s), Select SAML Password
3. Click OK.
4. Use the handle on the left of the newly created policy rule to drag it to the top of the current Policy Rules list.