Skip to main content
The ADFS connector integrates the Maverics Orchestrator with Microsoft Active Directory Federation Services — enabling authentication for applications that rely on ADFS for identity federation.
Console terminology: In the Maverics Console, this section is called Identity Fabric. The YAML configuration uses the connectors key to define identity provider integrations.

​
Overview

The ADFS connector integrates with ADFS using the SAML 2.0 protocol. It is designed for organizations modernizing their identity infrastructure — allowing you to migrate away from ADFS without disrupting existing applications or requiring simultaneous cutover of all relying parties.

​
Use Cases

  • ADFS-to-cloud migration — Gradually move relying parties from ADFS to a modern cloud IdP without downtime, reducing ADFS licensing and infrastructure costs
  • Unify SSO across ADFS and cloud IdPs — Bridge ADFS with cloud identity providers so users get seamless access across on-prem and cloud applications during migration
  • ADFS modernization without rip-and-replace — Add modern authentication capabilities like MFA and conditional access to ADFS-protected applications without modifying ADFS itself
  • ADFS failover and resilience — Pair ADFS with a backup IdP through the Continuity connector so authentication continues if the ADFS farm becomes unavailable

​
Setup

To create a Microsoft ADFS (SAML) connector in the Maverics Console:
  1. Navigate to Identity Fabric in the Console sidebar.
  2. Click Create and select Microsoft ADFS (SAML).
  3. Enter a Name — the friendly name for your ADFS provider.
  4. Enter the Metadata URL — the ADFS federation metadata endpoint (typically https://{adfs-host}/FederationMetadata/2007-06/FederationMetadata.xml).
  5. Enter the Consumer Service (ACS) URL — the URL where ADFS sends SAML responses after authentication.
  6. Enter the Entity ID — the unique identifier for the Orchestrator as the SAML Service Provider.
  7. Optionally enter a Logout Callback URL for Single Logout (SLO) callback.
  8. Optionally enter the SP Certificate Path and SP Private Key Path if your ADFS configuration requires signed SAML requests.
  9. Optionally enable IdP Initiated Login if authentication flows will be started from the ADFS side.
  10. Click Save.

​
Troubleshooting

  • Verify the ADFS federation metadata URL is accessible — The Orchestrator fetches the ADFS metadata XML at startup. The metadata URL is typically https://{adfs-host}/FederationMetadata/2007-06/FederationMetadata.xml. Test the URL with curl from the Orchestrator host.
  • Ensure the entity ID matches ADFS relying party configuration — The samlEntityID value must match the Relying Party Trust identifier configured in ADFS. Mismatched entity IDs cause ADFS to reject authentication requests.
  • Check the Assertion Consumer Service URL — The samlConsumerServiceURL must match the Orchestrator’s actual callback endpoint. If behind a load balancer or reverse proxy, use the external-facing URL that ADFS will redirect to.
  • SP signing certificate errors — If ADFS requires signed authentication requests, ensure samlSPCertPath and samlSPKeyPath point to valid PEM files and the key matches the certificate.

Identity Fabric

Overview of all identity providers

Generic SAML

Generic SAML 2.0 connector

Microsoft Entra ID

OIDC connector for Microsoft Entra ID

Continuity

Failover connector for IdP high availability