Lifesize Admin Console

Last Updated: Dec 13, 2022

Configure using AD FS

These instructions assume you are using Microsoft Active Directory Federated Service identity framework (AD FS) 2.0. If you are using a later version, make sure that Intranet Forms Authentication is enabled (Authentication Policies > Primary Authentication > Intranet Forms Authentication).

Configure AD FS

  1. Sign in to your AD FS management console.
  2. In the left navigation pane, select Relying Party Trust. In the right navigation pane, click Add Relying Party Trust.
  3. Click Start.
  4. In Select Data Source, choose Enter data about the relying party manually.
  5. In Specify Display Name, enter a name (for example, Lifesize Cloud) for the relying party you are creating (plus any notes).
  6. Choose AD FS 2.0 profile.
  7. Navigate to Service > Certificates.
  8. Select Token Signing Certificate and right-click to open Properties. In the details pane of the certificate, export to a Base-64 CER file.
  9. Open the Base-64 CER file in a text editor and paste the contents into the X.509 certificate section in the admin pane, making sure to include the -Begin- and -End- sections.
  10. Copy and save the Lifesize X.509 security certificate to a file named lifesize.crt.—–BEGIN CERTIFICATE—–
    MIIEHzCCAwegAwIBAgIJAOeNkbnxVVV/MA0GCSqGSIb3DQEBBQUAMIGlMQswCQYD
    VQQGEwJJTjELMAkGA1UECAwCS0ExEjAQBgNVBAcMCUJhbmdhbG9yZTERMA8GA1UE
    CgwITGlmZXNpemUxFzAVBgNVBAsMDkNvbW11bmljYXRpb25zMRowGAYDVQQDDBFs
    aWZlc2l6ZWNsb3VkLmNvbTEtMCsGCSqGSIb3DQEJARYecHJvZHVjdG1hbmFnZW1l
    bnRAbGlmZXNpemUuY29tMB4XDTE1MDcwNjEwMTIxNloXDTI1MDcwMzEwMTIxNlow
    gaUxCzAJBgNVBAYTAklOMQswCQYDVQQIDAJLQTESMBAGA1UEBwwJQmFuZ2Fsb3Jl
    MREwDwYDVQQKDAhMaWZlc2l6ZTEXMBUGA1UECwwOQ29tbXVuaWNhdGlvbnMxGjAY
    BgNVBAMMEWxpZmVzaXplY2xvdWQuY29tMS0wKwYJKoZIhvcNAQkBFh5wcm9kdWN0
    bWFuYWdlbWVudEBsaWZlc2l6ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
    ggEKAoIBAQDN6r/qWOveMypCpRBksGEVkLAeDcC08lQ0yxB3s3hEmAU6I7ZCr6JU
    sS1ldHXRR7ZJhKk148LOa0p5/3kbyD5p4rpG03LEVPNi43P8SA6Uct7OEu3to/aV
    jQlkLyXw9f2bX5BhdqGV7ftr8n1O9GMZAUwjd7LfrEvGrOM8R/IH60/L1SMpCyx2
    yIJ4vQ80gSonPYXvc7AnmnFjGLkYSOzBfETpxzGkgr9jqotADRjF6oEerxBhKcjQ
    VHIjQvW1Dt4jEQT1ndOzLt0Kw/MzrbxkokQ2JhGuGUWX1o/OPDrQ5nflYN9rhJgO
    SiTsB1e4T9loeZTUjDPi3y2dVWDZXM8tAgMBAAGjUDBOMB0GA1UdDgQWBBSe51Gq
    i8w/xJp/QMlTiHlY/hqwXzAfBgNVHSMEGDAWgBSe51Gqi8w/xJp/QMlTiHlY/hqw
    XzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQB6O0X7VS9dFaDQI30N
    Mgabvc3RRkn0QiIC42uX3NB9Lt75k/KWK5keOlTci339qZHatEii6ZkGp9eLrW/9
    7sCitBrM7RXRpYf7IVGTRLb6NYrKitM5wAxpFwj18/2DZi4ugg3DaFCAUz7jMi1L
    UMeu/X59ilFn5sx7wz+J/VJAHF2W17vdpBY6qXXAdv9BwO5ii4g5W0gWAcVQKL8k
    7kz7ZEx+Fpn3HT3vB09ZWrtIZlFttc/+B7C9kAvR69H73Exg1wHAuFfXeIwC3zTs
    sV7JXD2YJOCmC9Tp8mpXEAN9nEMFKBBmVVUCHQIn0tkt+LzJjFq0AkCNg542kTWg
    vWjt
    —–END CERTIFICATE—–
  11. In AD FS > Configure Certificate, use the Browse button to locate the certificate and upload it, then click Next.
  12. In Configure URL, select Enable support for the SAML 2.0 WebSSO protocol and enter this URL:https://login.lifesizecloud.com/ls/?acs
  13. In Configure Identifiers, enter this URL in Relying party trust identifier, making sure to include the closing slash /:https://login.lifesizecloud.com/ls/metadata/
  14. Click Add to move the identifier in the display list, then click Next.
  15. In Choose Issuance Authorization Rules, select Permit all users to access this relying party, then click Next.
  16. In Ready to Add Trust, review the settings then click Next to add the relying party trust to the AD FS configuration database.

You have created and defined a relying party. Next, create a claim rule determining how this relying party communicates with Active Directory.

Add a Claim Rule

  1. If the Edit Claims Rules window is not open, right-click on the relying party you created (Trust Relationships > Relying Party Trusts) and select Edit Claim Rules.
  2. Select the Issuance Transform Rules tab, then click Add Rule.
  3. In Select Rule Template, choose Send LDAP Attributes as Claims from the claim rule template dropdown menu, then click Next.
  4. In Configure Rule, name the claim rule, using a name that describes its purpose, for example Get Email attributes from AD.)
  5. Select Active Directory in the attribute store dropdown menu.
  6. Map your local LDAP Attributes to the matching Outgoing Claim Types values. Attribute names or statements (Given Name, Surname, Email Address) must match those in Lifesize Cloud.
  7. Click Finish.
  8. In Edit Claim Rules, select the Issuance Transform Rules tab, then click  Add Rule.
  9. In Select Rule Template, choose Send Claims Using a Custom Rule, then click Next.
  10. Assign a name, then enter this definition in the Custom rule field:c:[Type == “http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname”]=> issue(Type = “http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier”,
    Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType,
    Properties[“http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format”]= “urn:oasis:names:tc:SAML:2.0:nameid-format:transient”, Properties[“http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier”]= “https://login.lifesizecloud.com/ls/metadata/”);
  11. Click Finish, then click OK or Apply to save the rule.
  12. In the main AD FS window, select Relying Party Trusts from the left navigation.
  13. Right-click the Relying Party Trust you just added and select Properties.
  14. Select the Signature tab, then click Add...
  15. Browse to the lifesize.crt certificate file you saved earlier, and upload it to AD FS.
  16. Select the Advanced tab, and set Secure hash algorithm to SHA-1.
  17. Click OK when complete.

Configure, Test, and Enable SSO in the Lifesize app

Setting up AD FS on your Windows server automatically creates an XML-based metadata file at:

https://Your_Domain_Name/FederationMetadata/2007-06/FederationMetadata.xml

This metadata is exchanged between AD FS and the Lifesize app when a user is authenticated, forming the basis for a relying trust.

First, locate the FederationMetadata.xml file on your Windows server. Open it with any standard text editor.

  1. Sign in to the Lifesize admin console.
  2. Click on your profile name and choose Advanced Settings.
  3. Go to SSO Integration > SSO Configuration and complete these fields using the contents of your AD FS metadata file:
    • Identity Provider Issuer: Copy the <entityID> attribute from your metadata file and paste the URL in this field.
      For example, if your <entityID> attribute looks like this:<EntityDescriptor
      xmlns=”urn:oasis:names:tc:SAML:2.0:metadata”
      entityID=”http://your_domain/adfs/services/
      trust” ID=”_ad6616ef-6c0d-4866-b8ed-4d2c24e98e91″>Your entry for this field is:http://your_domain/adfs/services/trust
    • Login URL: Copy the <SingleSignOnService Location> attribute from your metadata file and paste the URL in this field.
      For example, if your <SingleSignOnService Location> attribute looks like this:<SingleSignOnService Location=”https://your_domain/adfs/ls/”
      Binding=”urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect”/>Your entry for this field is:https://your_domain/adfs/ls
    • Certificate: Copy the X.509 security certificate from the <Signature> definition of your metadata file, and then paste it in this field.
    NOTE: Do not use the certificate contained in the <KeyDescriptor> definition.
  4. In SAML Attribute Mapping, enter the URI values from your metadata file for the following mapping attributes:
    • First Name: If your metadata file contains a claim type describing first name like this:<auth:ClaimType xmlns:auth=”http://docs.oasisopen.org/wsfed/authorization/200706″
      Optional=”true” Uri=”http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname”>
      <auth:DisplayName>Given Name</auth:DisplayName> <auth:Description>The given name of the user</auth:Description></auth:ClaimType>Your entry in the First Name field is:http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
    • Last Name: Follow the same method for the surname attribute. In this example, your entry is:http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
    • Email: Follow the same method for the email address attribute. In this example, your entry is:http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
  5. Click Test to validate your settings with the AD FS identity provider server.
  6. Once testing is successful, select Enable SSO, then click Update.
  7. Click Save.