How to set up SSO using ADFS?

Active Directory Federation Services (ADFS) allows you to integrate Day.io Single Sign-On (SSO) with Microsoft Active Directory.

By configuring ADFS as the identity provider, employees can access Day.io using the same credentials as their Windows domain.

This configuration is done in the ADFS console and complemented with adjustments on the Day.io SSO screen.

1. Open the ADFS console

   • In the ADFS manager, select Relying Party Trusts.
     
     

2. Add a new relying party trust

   • In the Action panel, click Add Relying Party Trust.
     
     

3. Start the wizard

   • In the add trust wizard, select Claims aware and click Start.
     
     

4. Enter Day.io metadata

   • Copy the Audience metadata URL displayed on the SSO configuration screen in Day.io (more details in this article).

   • In ADFS, paste this URL in the Federation metadata address field and click Next.
     
     
     

5. Name the trust

   • Set a name for the relying party trust; the recommended default is api.oitchau.com.br.
     
     

6. Set authentication methods

   • Select the allowed authentication methods and the users/groups who will have access.
     
     

7. Finish creation

   • Proceed to the end of the wizard and click Finish.
     
     
     

8. Edit the claims issuance policy

   • In Action, click Edit Claim Issuance Policy.
     
     

9. Send LDAP attributes as claims

   • Select Send LDAP attributes as claims.
     
     

10. Create the claim rule

    • Set a name for the rule; choose the Attribute Store and map E‑mail.

    • Finish and apply the settings.
      
      
       

11. Set up mapping in Day.io

    • On the Day.io SSO screen, under Fields mapping, add the claim http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress as the mapping for the email field.

    • Click Save in Day.io.
      
      

12. Finish

    • After completing the steps, all users with an email from the configured domain will be able to access Day.io using their Active Directory credentials.
      
       

Configuring ADFS (video):

Tips and troubleshooting

• Use api.oitchau.com.br as the default name to facilitate future maintenance.

• Always map at least the email attribute so that Day.io can recognize the user.

• Make sure the ADFS certificate is up to date to avoid trust errors.

Best practices

• Test the integration with a user account before making it available to everyone.

• Document all configured URLs and claims.

• Restrict access only to groups that should use Day.io.

Frequently Asked Questions

1. Do I need to add more claims besides email? Only email is required; other fields are optional and depend on your company's access policy.

2. What happens if the ADFS certificate expires? You need to update the certificate in the ADFS console and in Day.io to maintain the integration.

3. Can I have more than one Relying Party Trust for Day.io? It is not recommended. Keep only one active configuration to avoid conflicts.