SSO - ADFS (Active Directory Federation Services) Setup Guide

This guide walks you through configuring Single Sign-On (SSO) between ADFS and RollCall using SAML 2.0.

Overview

By completing this setup, your users will be able to:

• Log into RollCall using their Active Directory credentials

• Avoid managing separate passwords

• Experience a secure and seamless login process

Before You Begin

Make sure you have:

• Admin access to your ADFS Server

• Access to the RollCall SSO Setup Wizard

• Your school’s RollCall domain (e.g. schoolname.rollcall.com.au)

⚙️ Step-by-Step Configuration (ADFS)

Step 1 – Open ADFS Management Console

1. Log into your ADFS server

2. Open:
   Server Manager → Tools → AD FS Management

Step 2 – Add Relying Party Trust

1. In the left panel, right-click:
   Relying Party Trusts

2. Select:
   Add Relying Party Trust

3. Choose:

   • Claims aware

4. Click Start

Step 3 – Select Data Source

1. Choose:
   Enter data about the relying party manually

2. Click Next

3. Enter:

   • Display Name: RollCall

Step 4 – Configure SAML Endpoint

1. Select Enable support for the SAML 2.0 WebSSO protocol

2. Add the following endpoint:

? This is the RollCall Assertion Consumer Service (ACS) endpoint.

Step 5 – Configure Relying Party Identifier

1. Add your school’s unique identifier:

Example:

bmgRollCallSSO

? This value must match what is configured in RollCall.

Step 6 – Configure Access Control Policy

1. Choose an access control policy, such as:

   • Permit everyone (recommended for initial setup/testing)
     or

   • Restrict to specific users/groups

Step 7 – Finish Setup

1. Complete the wizard

2. Ensure the relying party trust is created successfully

Configure Claims (Important)

After creating the trust:

1. Right-click your RollCall Relying Party Trust

2. Select Edit Claim Issuance Policy

Add the following claims:

? Ensure the email claim is present, as RollCall uses this to identify users.

Complete Setup in RollCall

Once ADFS is configured:

1. Open the RollCall SSO Setup Wizard

2. Enter your ADFS details:

   • SSO URL (ADFS endpoint)

   • Entity ID

   • Certificate

3. Map required attributes

4. Run a Test Login

5. Click Activate SSO

Testing the Integration

Before going live:

• Use a test account

• Confirm:

  • Successful login via ADFS

  • User is matched correctly in RollCall

❗ Troubleshooting Tips

? Key Notes

• RollCall uses email address to identify users

• Claims must include email, first name, last name

• SSO must be activated after testing

• Each school configuration is secure and isolated

✅ Summary

By completing this setup:

• Users log in via Active Directory credentials

• Authentication is handled securely via ADFS (SAML)

• Admins maintain full control via ADFS policies

Here to link to:

• SSO - Setting up your SSO Integration