Skip to main content
Skip table of contents

Authenticating with ADFS via OpenID Connect

ADFS Configuration

Add Application Group

  1. In AD FS Management right click Application Groups then select Add Application Group.
  2. Enter the following details and then click the Next button:

    OptionValue
    NameEzeScan WebApps
    TemplateWeb browser accessing a web application

  3. Enter the following details and then click the Next button:

    OptionValue
    NameEzeScan WebApps - Native application
    Redirect URI

    https://server.domain.com/signin-oidc

    This should be the URL you use to access EWA with a "/signin-oidc" on the end.

    Note: Be sure to click the "Add" button!

  4. Select your relevant access control policy and then click the Next button.
  5. Review the information and then click the Next button.
  6. Click the Close button.

Map Claims

  1. Right click the created Application Group and select Properties.
  2. Select the Web Application and click the Edit button.
  3. Select the Issuance Transform Rules tab and then click the Add Rule... button.
  4. Leave the default Send LDAP Attributes as Claims option and click the Next button.
  5. Enter the following details and then click the Finish button:

    OptionValue
    NameUser Info
    Attribute StoreActive Directory
    Mapping of LDAP attributes to outgoing claim types


    LDAP Attribute (Select or type to add more)Outgoing Claim Type (Select or type to add more)
    E-Mail-AddressesEmail Address
    User-Principal-NameUPN
    Display NameName
    Given-NameGiven Name
    SurnameSurname
    Token-Groups as SIDsRole

Locating the Client Id

  1. Right click the created Application Group and select Properties.
  2. Select the Native Application and click the Edit button.
  3. Note down the Client Id

EzeScan WebApps Configuration

  1. Locate the appsettings.json file found in the root directory of your EzeScan WebApps installation directory.
  2. Edit the appsettings.json file using your favorite text editor and modify the Authentication section to contain the following:

    appsettings.json

    JS
     "Authentication":{
          "EnableApiKey":true,
          "Providers":{
             "OpenIdConnect": {
                "Authority": "https://adfs-server.domain.com/adfs",
                "ClientId": "3d585d27-ba3b-44b6-a87f-be91c13b3de4",
                "MetadataAddress": "https://adfs-server.domain.com/adfs/.well-known/openid-configuration",
             }
          }
       }  

    You will need to substitute "adfs-server.domain.com" with your ADFS servers fully qualified domain name (FQDN).

    Be sure to substitute the value of "ClientId" with the "Client Id" set in ADFS. If you're unsure then see Locating the Client Id


  3. Save the appsettings.json file.
  4. Restart the IIS App Pool that runs EzeScan WebApps.
  5. Navigate to your EzeScan WebApps site and click the Login button.
  6. Try logging in as a valid ADFS user.
  7. After successfully logging in you will be redirected back to EzeScan WebApps and in the top right hand corner you should see your display name.



JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.