Information for users
Information for administrators
Trivia

Setting up automatic login with ADFS

General information

What is ADFS?

Active Directory Federation Services (ADFS) is a service provided by Microsoft that enables Single Sign-On (SSO) across organizational boundaries. It acts as an Identity Provider (IdP), passing user identities from your organization's Active Directory to external applications like nele.ai as SAML tokens—without the need to transmit passwords.

‍

Setting this up requires advanced knowledge of SAML 2.0, single sign-on, and your identity provider. Once initialized as described here, login can be configured via the nele.ai admin area at https://manage.nele.ai/sso; please also refer to the corresponding manual article on this topic.

‍

Members who receive a nele.ai account automatically via single sign-on are not automatically deleted or deactivated. These members can be deleted manually at https://manage.nele.ai/users.

‍

Prerequisites: Before you begin, ensure the following requirements are met:

‍

  • A running ADFS server (Windows Server 2012 or newer)
  • Administrator access to both the ADFS server and the nele.ai admin area
  • A valid SSL certificate for your ADFS instance

Step 1: Provide ADFS metadata

Before configuring nele.ai, you need the metadata from your ADFS server.

‍

With internet connection (recommended):‍

The metadata XML URL for your ADFS server typically follows this format:

‍

https://[your-adfs-server]/federationmetadata/2007-06/federationmetadata.xml

‍

Make a note of this URL – you will need it in the next step.

‍

Note: You can verify that the metadata is accessible by opening this URL in your browser. If configured correctly, an XML file will be displayed. If an error message appears, please contact your server administrator.

‍

‍Without internet connection:‍

Export the metadata XML file directly from your ADFS server and have it ready for upload.

Step 2: nele.ai – Configure SSO and retrieve metadata XML

In the admin area, navigate to https://manage.nele.ai/sso. Under Configuration types, select the option that matches your environment:

‍

Configuration via metadata XML URL (recommended):

Enter the metadata XML URL for your ADFS server that you noted in Step 1. This option is only available if your ADFS can connect to the internet.

‍

Configuration via metadata XML file:‍

If an internet connection is not possible, upload the metadata XML file exported in Step 1 directly instead.

‍

Then click Save. The configuration data will be applied automatically.

‍

Next, copy the metadata XML or its URL generated by nele.ai – you will need this for the subsequent configuration on the ADFS side.

Step 3: ADFS – Setting up the Relying Party Trust

A Relying Party Trust is the entry in ADFS that defines which external application (in this case, nele.ai) is trusted and which user information may be shared with it.

‍

Go to your ADFS server and open the ADFS Management Console. Navigate to the Relying Party Trusts folder and right-click to create a new entry. A configuration wizard will open – click Next.

‍

Under Select Data Source, choose the import option that matches your environment:

‍

With an internet connection:

‍Import data about the relying party published online or on a local network – Enter the metadata XML URL for nele.ai that you copied in Step 2.

Without an internet connection:‍

Import data about the relying party from a file – Select the metadata XML file you downloaded from nele.ai.

‍

Click Next and enter a descriptive name for the new entry under Display name, e.g., nele.ai. Click Next again – the remaining settings will be imported automatically from the XML.

‍

Continue by selecting Permit all users to access this relying party and clicking Next.

‍

Note: This setting initially grants access to all users. If you wish to restrict access to specific Active Directory groups, this access rule can be adjusted later by right-clicking the entry and selecting Edit Access Control Policy.

‍

You can review your settings on the subsequent summary screens. In the final step, leave the Open the Edit Claim Issuance Policy dialog checkbox selected so that the window for claim rules opens automatically. If it does not open automatically, you can right-click the entry and manually select Edit Claim Issuance Policy.

Step 4: Configure Claim Rules

Claim Rules determine which user information (known as claims, e.g., email address or username) is retrieved from Active Directory and passed to nele.ai as part of the SAML token. Two rules are required for nele.ai: one to retrieve the email address and one to convert it into the expected SAML format (Name ID).

‍

In the Claim Rules window, first create an initial rule:

‍

  1. Click Add rule and select the rule template Send LDAP attributes as claims. Click Next.
  2. Under Attribute store the entry Active Directory .
  3. In the left column, select (LDAP attribute) Email addresses and in the right column (Outgoing claim type) as well Email address .
  4. Confirm by clicking Finish.

Then, create a second rule:

‍

  1. Click Add Rule and select Transform an Incoming Claim. Click Next.
  2. Configure the following settings:
    1. Incoming claim type: E-mail address
    2. Outgoing claim type: Name ID
    3. Outgoing name ID format: Email
  3. Keep the default setting Pass through all claim and confirm with Finish.

Finally, click OK to close the editor.

Completion and testing

You can test a successful configuration using the login URL in the SSO section of the admin area. Access this URL – if set up correctly, you will be redirected to your identity provider, where you can sign in with your credentials.

‍

Once you have successfully logged in, you will be redirected to an overview page where you can choose whether to log in to the desktop app or the web app. Alternatively, you can download nele.ai for various operating systems from there.

‍

Note on certificate renewal: Certificates can only be updated automatically if ADFS has an internet connection. If it does not, the certificates will expire and users will no longer be able to log in. In this case, you must either replace the nele.ai metadata XML in ADFS or renew the ADFS metadata XML in nele.ai.