ADFS

Active Directory Federation Service (ADFS) bilan integratsiya kompaniyangiz xodimlariga bitta parol yordamida Planfix’ga kirishni imkonini beradi Yagona kirish (SSO). Bu avtorizatsiyani soddalashtiradi, xavfsizlikni oshiradi va hisoblarni boshqarishni osonlashtiradi.

Bir martalik kirish (SSO) ni sozlash

Planfixdagi bosqichlar

• Hisob boshqaruvi — Integratsiyalar — Single Sign-On bo‘limiga o‘ting.
• Active Directory Federation Service (ADFS) bilan integratsiyani yoqing.

Shundan so‘ng ADFS serveringizni sozlashga o‘ting.

ADFSdagi bosqichlar

Relying Party Trust yaratish

1. ADFS Management’da Trust Relationships — Relying Party Trusts bo‘limiga o‘ting va Add Relying Party Trust… tugmasini bosing.
2. Birinchi ekranda Claims aware ni tanlang — Next.
3. Select Data Source bosqichida Enter data about the relying party manually ni tanlang — Next.
4. Display name ni belgilang, masalan: Planfix.
5. Next → Next tugmalarini bosing.
6. Enable support for the SAML 2.0 Web SSO protocol ni belgilang.
7. Relying party SAML 2.0 SSO service URL maydoniga Planfixdagi integratsiya sozlamalaridan olingan URL’ni kiriting

   https://{account_planfix_url}/login/saml2/sso/adfs

8. Next tugmasini bosing.
9. Configure Identifiers bosqichida Add ni bosing va Planfix’dan olingan Identifier (Entity ID) ni kiriting

   https://{account_planfix_url}/saml2/service-provider-metadata/adfs

10. Next → Close tugmalarini bosing.

Claim issuance qoidalarini sozlash

• Yaratilgan Relying Party Trust ni tanlang, so‘ng o‘ng panelda Edit Claim Issuance Policy ni bosing.
• Add Rule… tugmasini bosing.

LDAP atributlarini yuborish

• Send LDAP Attributes as Claims ni tanlang.
• Next tugmasini bosing va quyidagilarni ko‘rsating:

LDAP Attribute	Outgoing Claim Type
Display-Name	Name
Given-Name	Given Name
Surname	Surname
User-Principal-Name	Email Address

• Finish tugmasini bosing.

Name ID ni Email formatida shakllantirish

1. Add Rule… tugmasini bosing.
2. Transform an Incoming Claim shablonini tanlang.
3. Maydonlarni to‘ldiring:
   1. Name: Format NameID as Email
   2. Incoming claim type: UPN
   3. Outgoing claim type: Name ID
   4. Outgoing Name ID format: Email
   5. Pass through all claim values: yoqilgan (✓)
4. Finish tugmasini bosing.

Muhim

Name ID uchun qo‘shimcha Send LDAP Attributes as Claims qoidani yaratmang — faqat Transform an Incoming Claim qoidasi <NameID Format="…"> elementining emailAddress formatidan foydalanishini taʼminlaydi.

Yakuniy qadam

• Planfix’ga qayting va ADFS integratsiya sozlamalarida Metadata URI maydoniga quyidagilarni kiriting:

  https://<adfs-server>/FederationMetadata/2007-06/FederationMetadata.xml

• O‘zgartirishlarni saqlang.

O‘tish

• Yagona kirish (SSO)
• Integratsiyalar