Configure Adobe Workfront with SAML 2.0 using ADFS

Last update: February 7, 2025

Topics:
System Setup and Administration

CREATED FOR:

Admin

IMPORTANT

The procedure described on this page applies only to organizations that are not yet onboarded to the Adobe Admin Console.

If your organization has been onboarded to the Adobe Admin Console, see Platform-based administration differences (Adobe Workfront/Adobe Business Platform).

As an Adobe Workfront administrator, you can integrate Workfront with a Security Assertion Markup Language (SAML) 2.0 solution for single sign-on while using Active Directory Federation Services (ADFS).

This guide focuses on setting up ADFS without auto provisioning or attribute mappings. We recommend that you complete the setup and test it prior to setting up any auto provisioning.

Access requirements

Expand to view access requirements for the functionality in this article.

You must have the following access to perform the steps in this article:

Adobe Workfront plan

Any

Adobe Workfront license

Plan

Access level configurations

You must be a Workfront administrator.

NOTE: If you still don't have access, ask your Workfront administrator if they set additional restrictions in your access level. For information on how a Workfront administrator can modify your access level, see Create or modify custom access levels.

Enable authentication to Workfront with SAML 2.0

To enable authentication to the Workfront web application and the Workfront mobile application with SAML 2.0, complete the following sections:

Retrieve the Workfront SSO metadata file
Configure Relying Party Trusts
Configure Claim Rules
Upload the metadata file and test the connection

Retrieve the Workfront SSO metadata file

Click the Main Menu icon in the upper-right corner of Adobe Workfront, or (if available), click the Main Menu icon in the upper-left corner, then click Setup .
In the left panel, click System > Single Sign-On (SSO).
In the Type drop-down menu, click SAML 2.0 to display additional information and options.
Copy the URL that displays after Metadata URL.
Continue to the following section, Configure Relying Party Trusts.

Configure Relying Party Trusts

Open the ADFS Manager using the Windows server 2008 R2 (version may vary).
Go to Start.
Click Administration Tools.
Click ADFS 2.0 Management.
Select ADFS and expand Trust Relationships.
Right-click Relying Party Trusts, then select Add Relying Party Trust to launch the Add Relying Party Trust Wizard.
From the Welcome Page, select Start.
In the Select Date Source section, paste the metadata URL from Workfront.
Click Next.
Click OK to acknowledge the warning message.
In the Specify Display Name section, add a Display Name and Notes to distinguish the Trust, then click Next.
Select Permit all user to access this relying party (Or None if you want to configure this later).
Click Next.

This takes you to the Ready to Add Trust section.
Continue to the following section Configure Claim Rules.

Configure Claim Rules

Click Next in the Ready to Add Trust section, then ensure that the Open the Edit Claim Rules dialog box option is selected.

This will allow you to edit Claim Rules in a future step.
Click Close.
Click Add Rule.
Select Send LDAP Attribute as Claims.
Click Next to display the Configure Claim Rule step.

Specify the following minimum requirements to configure the claim rule: (This will go in the Federation ID on the user setup and is used to distinguish who is logging in.)

Claim rule name	Specify a name for the claim rule. For example, "Workfront."
Attribute store	Select Active Directory from the drop-down menu.
LDAP Attribute	This can be any type of attribute. We recommend using SAM-Account-Name for this attribute.
Outgoing Claim Type	You must select Name ID as the outgoing claim type

(Optional) In order to establish auto provisioning, add the following additional claims in both the LDAP Attribute and Outgoing Claim Type:
- Given Name
- Surname
- E-Mail Address
Click Finish, then click OK on the next screen.
Right-click the new Relying Party Trust, then select Properties.
Select the Advanced Tab. And under Secure Hash Algorithm select SHA-1 or SHA-256.

NOTE
The option that you select under Secure Hash Algorithm must match the Secure Hash Algorithm field in Workfront under Setup > System > Single Sign-ON (SSO).
Continue to the following section Upload the metadata file and test the connection.

Upload the metadata file and test the connection

Open a browser and navigate to https://<yourserver>/FederationMetadata/2007-06/FederationMetadata.xml .

This should download a Metadata file FederationMetadata.xml file.
Click Choose File under Populate fields from Identity Provider Metadata, and select the FederationMetadata.xml file.
(Optional) If the certificate information did not populate with the metadata file, you can upload a file separately. Select Choose File in the Certificate section.
Click Test Connection. If set up correctly, you should see a page similar to the one shown below:

NOTE
If you want to set up attribute mapping, ensure that you copy the attributes from the Test Connection into the Directory Attribute. For more information, see Mapping User Attributes.
Select Admin Exemption to allow Workfront administrators to log in using Workfront credentials with the bypass url.

Bookmarks pointing to <yourdomain>.my.workfront.com/login bypass the redirect.
Select the Enable box to enable the configuration.
Click Save.

About updating users for SSO

Following this guide, the SSO Username will be their Active Directory Username.

As a Workfront administrator, you can bulk update users for SSO. For more information about updating users for SSO, see Update users for single sign-on.

As a Workfront administrator, you can also manually assign a Federation ID editing the user’s profile and completing the Federation ID field. For more information about editing a user, see Edit a user’s profile.

NOTE

When editing users’ profiles to include a Federation ID, selecting Only Allow SAML 2.0 Authentication removes the ability to log in to Workfront using the bypass url (<yourdomain>.my.workfront.com/login).

recommendation-more-help