Setting up SSO SAML via Active Directory Federation Services (ADFS)

This article outlines the steps to set up Single Sign-On (SSO) SAML via Active Directory Federation Services (ADFS).

Note: Productboard SAML SSO capabilities are limited to provisioning new users and logging in existing users. Permissions and deactivation of users are managed in-app.

In this article:

• Table of values
• Setting up SSO SAML
• Troubleshooting

Table of values

The table below shows a summary of the values you'll need when setting up SSO.

https://{workspace_name}.productboard.com/

https://{workspace_name}.productboard.com/users/auth/saml/callback

https://{workspace_name}.productboard.com/users/auth/saml/slo

Setting up SSO SAML

1. On your ADFS Server, open AD FS Management.
   
   
2. Right-click Relying Party Trusts and click Add Relying Party Trust. This launches the Add Relying Party Trust Wizard.
   
   
3. Click Select Data Source and choose Enter data about the relying party manually.
   
   
4. On the Specify Display Name step, enter "Productboard" as the display name and click Next.
   
   
    
5. Choose AD FS profile with SAML 2.0 and click Next.
   
   
    
6. Select Enable support for the SAML 2.0 SSO Web SSO protocol and enter the Single SignOn URL from the table above in the Relying party SSO service URL field. Click Next.
   
   
    

7. Add a Relying party trust identifier, for example:

   {workspace_name}.productboard.com/

   Also add:

   https://{workspace_name}.productboard.com/

   Click Next.
   
   
    

8. Click Next until you reach the Finish screen.
9. Select Open the Edit Claim Rules dialog before clicking Finish. This launches the Edit Claim Rules window.
   
   
    
10. Click Add Rule and choose Claim Rule > Send LDAP Attributes as Claims.
    
    
    
    • Email Address = User identifier/NameID.
    • First Name accepted formats:
      • Givenname.
      • FirstName.
      • First_name.
      • Firstname.
      • firstName.
      • User.FirstName.
    • Last Name accepted formats:
      • surname.
      • LastName.
      • last_name.
      • lastname.
      • lastName.
      • User.LastName.
11. Add the Outgoing claim type as shown below. Click Finish.
    
    
    Productboard uses each user's email address as a login ID. To make this work, set up the email as the NameID on the SAML login request using a Transform Rule.
12. Click Add Rule again, select Transform an Incoming Claim, and click Next.
    
    
     
13. Enter a Claim rule name (for example, "NameIDProductboard"), set the Outgoing claim type to NameID, and click Finish.
    
    
     
14. Confirm the rule order matches the image below (LDAP/AD Attributes followed by NameIDProductboard) and click Apply.
    
    
     
15. In the AD FS Management window, right-click the Relying Party for Productboard and choose Properties. Under the Advanced tab, set the Secure Hash Algorithm to SHA-256. SHA-1 is also supported.
16. In the AD FS Management window, choose Services > Certificates and double-click Token Signing Certificate. Select Copy to file to export the X.509 certificate.
    
    
    
     
17. Decide what roles users and teams should be authenticated as. Productboard has four roles: maker admin, maker, contributor, and viewer.
    • The default role for new members authorized via SAML SSO is contributor. Use the pb_role custom attribute to specify a different role.
    • Supported values for pb_role are admin, maker, contributor, and viewer.
18. Log in to your Productboard instance and navigate to Settings > Enforce SSO SAML > Manual Configuration.
    
    
     
19. Enter the following:
    • ADFS SSO Endpoint URL.
    • ADFS Server Certificate: paste the full X.509 certificate exported in the previous step.
    • Fingerprint: leave this field blank when providing the full certificate. Productboard derives the thumbprint automatically.
    • SLO Endpoint.

    • Audience / Entity ID (optional).

      Note: To find the Endpoint URL, open your ADFS manager and select the Endpoints folder in the left sidebar. Search for the SSO service endpoint and the entity URL. The SSO service URL typically ends in adfs/services/ls.

20. Click Save & authorize to enforce SSO via ADFS. You can now log in to Productboard with ADFS SAML SSO.

Troubleshooting

Q: We're switching to another IdP. How do I disable SSO?

Disable the SAML SSO integration at any time from Productboard settings.

The next time members log in, those who have never set a Productboard password will be prompted to reset it via email. Reset passwords at: https://app.productboard.com/password_resets/new.

Q: My certificate expired and I lost access to Productboard. How do I update the certificate?

Contact support via the chat widget in the bottom right of the page, or email support@productboard.com. The support team can disable SAML so you can log in and update the certificate manually.

Q: I've authorized SAML SSO but forgot to add users in my Identity Provider (IdP). What should I do?

The space owner can contact the support team to remove the authorized SAML SSO settings. The request must come from an admin who has ownership of the space.