![SSO in Pachca with ADFS OpenID](https://pachca.com/help/sso5.jpg)

# SSO in Pachca with ADFS OpenID

> This guide explains how to configure ADFS on Windows Server 2016 or later to connect it to Pachca. A detailed guide with examples

Источник: https://pachca.com/en/help-center/administration/sso-adfs-openid

## This guide explains how to configure ADFS on Windows Server 2016 or later to connect it to Pachca.

Open the **AD FS Management** tool.

![AD FS Management tool in Windows Server](https://pachca.com/help/sso-adfs-openid-1762628465096-398bg9.png)

Click **Add Application Group…**.

![Add Application Group button in ADFS](https://pachca.com/help/sso-adfs-openid-1762628466192-6gij.png)

Enter any name (for example, "Pachca").

Select the **Server application** type and click **Next**.

![Setting the application name and selecting the Server application type](https://pachca.com/help/sso-adfs-openid-1762628467015-2dbpcl.png)

Save the value of the **Client Identifier** field.

Enter the Redirect URI we give you.

![Client Identifier and Redirect URI fields](https://pachca.com/help/sso-adfs-openid-1762628467785-7lgq35.png)

Turn on **Generate a shared secret** and copy the generated code.

![Generating a shared secret for the application](https://pachca.com/help/sso-adfs-openid-1762628468812-q1y3r7.png)

Send us these values:

- **Client Identifier**
- **Secret**
- The URL of your ADFS server

‍

Review the configuration and click **Next** to finish.

![Reviewing the application configuration](https://pachca.com/help/sso-adfs-openid-1762628469727-45bowl.png)

> ADFS needs extra configuration to work with OpenID. See [Microsoft's guide to custom ID tokens in AD FS](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/development/custom-id-tokens-in-ad-fs).

Select the object you created and click **Properties**.

![Opening Properties of the created object](https://pachca.com/help/sso-adfs-openid-1762628470483-vhqjys.png)

In the object settings, click **Add application**.

![Add application button in the settings](https://pachca.com/help/sso-adfs-openid-1762628471359-f6q28x.png)

Select the **Web API** type.

![Selecting the Web API type](https://pachca.com/help/sso-adfs-openid-1762628472236-y7fzij.png)

In the **Identifier** field, enter your **Client Identifier**.

![Setting the Identifier for the Web API](https://pachca.com/help/sso-adfs-openid-1762628473317-mzv4ms.png)

> Leave **Access Control Policy** set to **Permit everyone**, unless you need finer control over how your users work with the authentication app.

![Access Control Policy: Permit everyone](https://pachca.com/help/sso-adfs-openid-1762628474373-yp5fai.png)

Under **Permitted scopes**, select **allatclaims** and **openid**.

![Selecting Permitted scopes: allatclaims and openid](https://pachca.com/help/sso-adfs-openid-1762628475193-1sxmie.png)

Review the settings and finish the configuration.

![Final review of the Web API settings](https://pachca.com/help/sso-adfs-openid-1762628476050-csve5.png)

‍

‍

### Pass employee attributes to Pachca

> Pachca needs user data to work, so set up ADFS to pass it in the OpenID token.

Select the **Web API** you created and click **Edit**.

Go to the **Issuance Transform Rules** tab and click **Add Rule…**.

![Issuance Transform Rules tab](https://pachca.com/help/sso-adfs-openid-1762628478255-ze3tzm.png)

Click **Next**.

![Add Transform Claim Rule wizard](https://pachca.com/help/sso-adfs-openid-1762628479617-6qkgw6.png)

In the **Claim rule name** field, enter any name (for example, "User profile").

In the **Attribute store** field, select **Active Directory**.

Fill in the table with these values:

- E-Mail-Addresses: email
- Given-Name: firstName
- Surname: lastName

Click **Finish** to complete the configuration.

![Mapping Active Directory attributes](https://pachca.com/help/sso-adfs-openid-1762628480603-6r0y5.png)

> We can also agree on passing other fields to Pachca to fit your needs. To pass them, add them to this table and tell us the name of the custom **Outgoing Claim Type**.

Pachca profile fields and their attribute names:

- Phone: phone\_number
- Job title: title
- Department: department
- [Group tags](https://pachca.com/en/help-center/administration/tags-team-members): group\_tags

You can also pass any other text fields from your directory to Pachca, such as an employee's manager or birthday. To do this:

1.  Create the field in Pachca: go to **Members** → **Settings** → **Add field**, then set a name and any type except **File**
2.  Enter the attribute name in the mapping, as described above for the standard profile fields

**Once the mapping is set up, let our support team know so they can connect it.**

‍

‍

### Troubleshooting

**Error on the ADFS sign-in page**

![Error on the ADFS sign-in page](https://pachca.com/help/sso-adfs-openid-1762628481383-5kee7o.png)

To allow sign-in through the Identity Provider, run this PowerShell command:

```powershell
Set-AdfsProperties -EnableIdPInitiatedSignonPage $true
```

‍

**Error after signing in to ADFS successfully**

![Error after signing in to ADFS successfully](https://pachca.com/help/sso-adfs-openid-1762628482050-4094ak.png)

The server time may be wrong. Check your NTP sync.

‍

‍

### Test the setup

On the [Pachca login screen](https://app.pachca.com/signin), click **With email**.

![With email button on the Pachca login screen](https://pachca.com/help/sso-adfs-openid-1762628482733-4trpv.png)

Click **Log in with SSO**.

![Log in with SSO button](https://pachca.com/help/sso-adfs-openid-1762628483281-dxw8p.png)

In the email field, enter your work email from AD.

Sign in through your company's system.

‍

**"Cookie not found" error**

![Cookie not found error on a mobile device](https://pachca.com/help/sso-adfs-openid-1762628483850-y7gsgr.png)

If you see the error "Cookie not found. Please make sure cookies are enabled in your browser" when logging in on a mobile device, set Google Chrome as your default browser for opening links.

Updated: February 17, 2025