SSO: Configure ADFS for use with InVision V7

Getting set up to use ADFS with InVision V7 involves the following primary tasks:

1. Set up the hash algorithm
2. Download InVision metadata
3. Create a new Relying Party Trust
4. Add a claim rule to send the email address of your user
5. Add a Transform Claim Rule
6. Configure ADFS in InVision V7

We recommend that these steps are completed by your IT team or an IT Manager.

Set up the hash algorithm

In ADFS, visit your Advanced tab for the InVision application, then select SHA-256 from the Secure hash algorithm menu. Select OK.

Download InVision metadata

Download InVision's SAML metadata from this URL: https://your_enterprise_subdomain.invisionapp.com/sso/metadata
You’ll need this when creating a new Relying Party Trust in ADFS.

Create a new Relying Party Trust

First, you’ll need to open the ADFS 2.0 MMC snap-in and a new “Relying Party Trust” that you can configure to work with InVision. That will walk you through the following steps:

1. In the Select Data Source step, import the XML metadata you downloaded from this URL: https://your_enterprise_subdomain.invisionapp.com/sso/metadata
2. Give the trust a Display Name like “InVision” and select Next.
3. Select the Permit all users to access this relying party option and then select Next.
4. Check the Open the Edit Claim Rules Dialog and select Close.

Add a claim rule to send the email address of your user

In the Edit Claim Rules window, do the following:

1. Click Add Rule to begin creating a new Claim Rule.
2. Select Send LDAP Attributes as Claims as the rule template.
3. Title the rule "Send UPN as Email" (you should tweak this title if you use a different attribute in step 5).
4. Select Active Directory as your Attribute Store.
5. Set User-Principal-Name (or whatever LDAP attribute contains the primary email address for your users) as the LDAP attribute.
6. Add E-mail Address as the Outgoing Claim Type.
7. Select OK to create the rule.

Add a Transform Claim Rule

After you've added a new rule to send the email address as a claim, add a Transform Claim rule to transform it into the proper NameID format:

1. Click Add Rule again to add a new rule and select "Transform an Incoming Claim" as the rule template.
2. Enter "Transform Email to Name ID" for the "Claim rule name."
3. Select E-Mail Address as the "Incoming claim type."
4. Select Name ID for the "Outgoing claim type."
5. Select Email for the "Outgoing name ID format."
6. Make sure Pass through all claim values is selected (it should be by default).
7. Select OK to save your rule.
8. Verify that this new rule is below the initial rule you created and select OK again to close the rule editor.

Configure ADFS in InVision V7

The owner or an admin on your Enterprise must configure ADFS in your InVision V7 account. Save the metadata file ADFS provides, and then complete these steps:

1. Sign in to your InVision Enterprise here: your-team-name.invisionapp.com
2. In the lower-left corner, select the [Your Team Name] dropdown, and then select People & Team settings.
   
   Note: The Team page opens with the People tab active.
3. Select Settings tab, and then select Single sign-on.
4. Turn on Require SSO for every member of [your enterprise team].
5. Fill out the fields using the appropriate information from the ADFS metadata file.
6. Select Update.