Book a demo
Sign Up
Organization Single Sign-On (SSO)

Set Up SSO with Microsoft ADFS

With ADFS, TestInvite is added as a relying party trust (SAML) or an application group (OpenID Connect), and a claim rule must send the user's email — as an attribute and, for SAML, as the Name ID.

Published 2026/10/19

This guide is for the ADFS administrator. It covers ADFS on Windows Server 2016 and later. You need your TestInvite organization ID; in the steps below, replace <ORG-ID> with it and adfs.company.com with your ADFS host name. Choose SAML or OpenID Connect — you only need one.

Option A — SAML 2.0 (recommended for ADFS)

SAML works even when ADFS is only reachable from your internal network or VPN: TestInvite's servers never connect to ADFS.

Step 1. Add TestInvite as a relying party trust

  1. Open AD FS Management → Relying Party Trusts → Add Relying Party Trust… → Claims aware → Start.
  2. Choose Import data about the relying party published online or on a local network and enter https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/saml/metadata.
    If the ADFS server has no internet access: download that URL on any computer (or use Download metadata in TestInvite) and choose Import data about the relying party from a file.
  3. Display name: TestInvite.
  4. Access control policy: choose who may use TestInvite (for example Permit everyone or a group-based policy).
  5. Finish, keeping Configure claims issuance policy for this application checked.

Entering the values by hand instead: choose Enter data about the relying party manually; skip the token encryption certificate (or add TestInvite's certificate from its metadata); check Enable support for the SAML 2.0 WebSSO protocol and enter the ACS URL https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/saml/acs; add the relying party trust identifier https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/saml/metadata.

Step 2. Send the email and name (claim rules)

In Edit Claim Issuance Policy for TestInvite, add two rules:

  1. Send LDAP Attributes as Claims — name TestInvite attributes, attribute store Active Directory:
    E-Mail-Addresses → E-Mail Address
    Given-Name → Given Name
    Surname → Surname
    Display-Name → Name
  2. Transform an Incoming Claim — name Email as Name ID: incoming claim type E-Mail Address → outgoing claim type Name ID, outgoing name ID format Email, Pass through all claim values.
If some users have no mail attribute in Active Directory, use User-Principal-Name instead of E-Mail-Addresses — but only when the UPN equals the real email address. The address must be on one of your SSO domains in TestInvite.

Step 3. Enter ADFS in TestInvite

  1. In TestInvite: Organization → Configure → Sign-in & Security → edit → Single Sign-On, protocol SAML 2.0.
  2. Identity provider metadata URL: https://adfs.company.com/FederationMetadata/2007-06/FederationMetadata.xml → Import.
    If ADFS is not reachable from the internet, open that URL from inside your network, save the file and use Upload metadata XML.
  3. Check the imported values: Entity ID http://adfs.company.com/adfs/services/trust, SSO URL https://adfs.company.com/adfs/ls/, and the token-signing certificate.
  4. Add your email domains, choose enforcement and automatic user creation, then Test SSO.

Optional ADFS settings

  • Signed requests: if you run Set-AdfsRelyingPartyTrust -TargetName TestInvite -SignedSamlRequestsRequired $true, turn on Sign authentication requests in TestInvite and refresh TestInvite's metadata in ADFS (Update-AdfsRelyingPartyTrust -TargetName TestInvite).
  • Encryption: ADFS encrypts assertions when the relying party has an encryption certificate (it does when imported from TestInvite's metadata). TestInvite always accepts encrypted assertions; turn on Require encrypted assertions to make it mandatory.
  • Sign-on page tile: link it to TestInvite's Sign-in URL https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/initiate. If you use the ADFS IdP-initiated sign-on page instead, turn on Allow sign-in from the identity provider portal.
  • Certificate renewal: ADFS rolls its token-signing certificate automatically (AutoCertificateRollover). With the metadata URL imported, TestInvite follows the change by itself. With an uploaded file, add the new certificate in TestInvite before ADFS promotes it.

Option B — OpenID Connect

With OpenID Connect, TestInvite's servers call ADFS (token endpoint and keys). https://adfs.company.com/adfs/oauth2/token and https://adfs.company.com/adfs/discovery/keys must be reachable from the internet.

Step 1. Create an application group

  1. AD FS Management → Application Groups → Add Application Group… → name TestInvite, template Server application accessing a web API.
  2. Server application: copy the Client Identifier. Add the redirect URI https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/oidc/callback.
  3. Configure Application Credentials: check Generate a shared secret and copy it now (it is shown once).
  4. Configure Web API: identifier = the same Client Identifier.
  5. Access control policy: choose who may sign in.
  6. Configure Application Permissions: permitted scopes openid, email, profile, allatclaims.

Step 2. Put the email into the ID token

Open the application group → the Web API → Issuance Transform Rules → add Send LDAP Attributes as Claims: E-Mail-Addresses → E-Mail Address, Given-Name → Given Name, Surname → Surname. The allatclaims scope copies these claims into the ID token.

Step 3. Enter ADFS in TestInvite

  • Protocol: OpenID Connect
  • Issuer URL: https://adfs.company.com/adfs
  • Client ID: the Client Identifier; Client secret: the shared secret
  • Client authentication: Basic (Post also works)
  • Scopes: openid email profile allatclaims

Then add your email domains and run Test SSO. If the test reports EMAIL_MISSING, check the transform rule and the allatclaims scope; the report lists every claim ADFS sent.

Go back