SAML Setup Guide for ADFS

This topic provides instructions for setting up SAML authentication on a Blackboard Learn instance with Active Directory Federation Services (ADFS) as the Identity Provider (IdP). Your Blackboard Learn environment acts as the Service Provider (SP). While these steps use ADFS version 3.0 with Windows Server 2012 R2, the steps can also be applied to ADFS 2.0.

Learn Service Provider

Login to Blackboard Learn as an administrator and navigate to System Admin > Authentication.
Select Create Provider > SAML.
Enter the following settings:
- Name > Type ADFS SAML or anything you want.
- Authentication Provider > set as Inactive.
- User Lookup Method > Username
- Restrict by Hostname > Use this provider for any hostnames.
- Link Text > Type ADFS Login or anything you want.
Select Save and Configure.
In the Entity ID field, ensure the value is the same as the ACS URL.
Select Enable Automatic SSO Single Logout Service Type Post and Allow ADFS LogoutResponse. Leave Redirect deselected or unchecked.
Under Service Provider Metadata, select Generate and save the XML file to your desktop.
If you're using JIT, it's recommended to create a new Data Source for this provider named SAML, otherwise use SYSTEM or whatever you choose.
Select the Enable JIT Provisioning checkbox to allow the system to automatically create an account when an unknown user attempts to login via this SAML authentication provider. If it is not selected, the user account will first need to be manually created in Blackboard Learn.
In the Compatible Data Sources list, be sure to select the data sources that this authentication provider should be compatible with.
Select Point Identity Provider for the Identity Provider Type.
For the Identity Provider Metadata, select metadata URL and set the URL to be one of your ADFS metadata URLs. https://[adfs server hostname]/FederationMetadata/2001-03/FederationMetadata.xml and select Validate.
The ADFS server ideally needs to have a commercial certificate. If it's using a self signed certificate, the validate will fail. You'll need to download the FederationMetadata.xml file and use the Metadata File option instead.
Select Submit.

ADFS Identity Provider

On the ADFS Server, access the ADFS Management Console.
Navigate to Trust Relationships > Relying Party Trusts > Add Relying Party Trust.
Select Start on the Add Relying Party Trust Wizard page.
Select Import Data about the relying party from a file.
Select Browse and upload the file that was created in Step 6 of the Learn SP section. Select Next.
Enter a Display name such as yourlearnserver.blackboard.com and select Next.
Select I do not want to configure multi-factor authentication settings... and select Next.
Select Permit All Users to Access this Relying Party and select Next.
Select Next on the Ready to Add Trust step and then select Close on the Finish step.
After the Relying Party Trust has been created, it should open the Edit Claims Rules if the last checkbox was left checked. Otherwise right-click the Relying Party Trust and select Edit Claims.

Add claim rules for relying party trust

Send attributes as claims

Adding claim rules for the Relying Party Trust sends LDAP attributes as claims from the ADFS server to Blackboard Learn. In the ADFS management console, right-click the Relying Party Trust.

Send username

On the Issuance Transform Rules tab, select Add Rule.
On the Select Rule Template page, select Send LDAP Attributes as Claims as the Claim rule template and select Next.
On the Configure Rule page, in the Claim rule name box, type Transform Username to NameID.
In the Attribute Store dropdown, select Active Directory.
In the Mapping box on the left side select SAM-Account-Name or Company.
In the Mapping box on the right side type SamAccountName and select Finish.

The Name ID attribute needs to be a minimum length of 6 characters

Send first and last name (optional)

If the JIT Provisioning option is selected on the Blackboard Learn SAML Authentication Settings page, meaning user accounts will be created in Blackboard Learn if they don't exist, then the First and Last Name LDAP attributes can also be sent from ADFS to Blackboard Learn by mapping the attributes accordingly.

On the Issuance Transform Rules tab, select Add Rule.
On the Select Rule Template page, select Send LDAP Attributes as Claims as the Claim rule template and select Next.
On the Configure Rule page, in the Claim rule name box, type Send First Name.
In the Attribute Store dropdown, select Active Directory.
In the Mapping box on the left side select Given-Name.
In the Mapping box on the right side type urn:oid:2.5.4.42 and select Finish.
On the Issuance Transform Rules tab, select Add Rule.
On the Select Rule Template page, select Send LDAP Attributes as Claims as the Claim rule template and select Next.
On the Configure Rule page, in the Claim rule name box, type Send Last Name.
In the Attribute Store dropdown, select Active Directory.
In the Mapping box on the left side select Surname.
In the Mapping box on the right side type urn:oid:2.5.4.4 and select Finish.

Transform an incoming claim

Select Add Rule.
On the Select Rule Template page, select Transform an Incoming Claim for the Claim rule template and select Next.
On the Configure Rule page, in the Claim rule name box, type Transform Email to Name ID.
Incoming claim type should be SamAccountName. It must match the Outgoing Claim Type created in the earlier rule.
The Outgoing claim type is Name ID.
The Outgoing name ID format is Unspecified.
Confirm Pass through all claim values is selected and select Finish.
Select OK to save the rule and OK again to complete the attribute mappings.

Example attribute statement

After adding all of the previously mentioned claim rules for the Relying Party Trust, the rules appear in the Issuance Transform Rules tab.

Subject and AttributeStatement elements similar to the following will be sent in the SAML POST from ADFS to Blackboard Learn after the user has been authenticated:

<Subject>
<NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified ">luke.skywalker</NameID>
[SNIP]
</Subject>

<AttributeStatement>
<Attribute Name="SamAccountName">
<AttributeValue>luke.skywalker</AttributeValue>
</Attribute>
<Attribute Name="urn:oid:2.5.4.42">
<AttributeValue>Luke</AttributeValue>
</Attribute>
<Attribute Name="urn:oid:2.5.4.4">
<AttributeValue>Skywalker</AttributeValue>
</Attribute>
</AttributeStatement>

If the attributes from the IdP are not encrypted in the SAML response, the Firefox browser SAML tracer Add-on or Chrome SAML Message Decoder can be used to view the attributes that are being released from the IdP and sent to Blackboard Learn during the authentication process.