Step 2 - Creating Claim Rules

1. By default, the Claim Rules editor opens.
   Click on Add Rule to create a new rule.
2. In the Claim rule template list, select the Send LDAP Attributes as Claims template, and then click Next.
   
3. On the next screen, using Active Directory as your attribute store, create the following rule:
   
1. Enter a descriptive rule name
   
2. Attribute Store: Active Directory
   
3. Add the following mapping:
   
4. From the LDAP Attribute column, select E-Mail Addresses.
   
5. From the Outgoing Claim Type, select E-Mail Address.
   
6. Click OK to save the new rule.
   
4. Create another new rule by clicking Add Rule. This time select Transform an Incoming Claim as the template and then click Next.
   
5. On the next screen do the following:
   
1. Enter a descriptive rule name
   
2. Select E-mail Address as the Incoming Claim Type.
   
3. For Outgoing Claim Type, select Name ID.
   
4. For Outgoing Name ID Format, select Email.
   
5. Leave the rule to the default of Pass through all claim values.
   
6. Finally, click OK to create the claim rule, and then OK again to finish creating rules.

Step 3 - Adjusting the Trust Settings

1. Go to AD FS Management window.
   
2. In the Relying Party Trusts list, double-click the relying party object that you created
   (or select Actions > Properties while you have the Relying Party Trust selected).
3. Click the Advanced tab.
   
4. Make sure SHA-256 is specified as the secure hash algorithm.
   
5. In the Endpoints tab, click add SAML to add a new endpoint.
   
6. For the Endpoint type, select SAML Logout.
   
7. For the Binding, choose POST.
   
8. For the Trusted URL, create a URL using:
   
1. The web address of your ADFS server.
   
2. The ADFS SAML endpoint you noted earlier.
   
3. The string ‘wa=wsignout1.0’
   
4. The Trusted URL should look something like this: https://sso.yourdomain.tld/adfs/ls/?wa=wsignout1.0
   
9. Leave the Response URL blank.
   
10. Click OK twice. You should now have a working relying party trust for Zoho Desk.

Step 4 - Exporting Certificate from the AD FS Server

1. Open AD FS 2.0 MMC and navigate to Service > Certificates.
   Here, you will find the Token-signing certificate for your AD FS server that is used to authenticate your SAML connection from Zoho Desk.
2. Under Token-signing, right-click the certificate and select View Certificate.
   
3. Click the Details tab and then click Copy to File.
   The Certificate Export Wizard opens.
4. Click Next.
   
5. In the Export File Format window, select the Base-64 encoded X.509 (.CER) option and click Next.
   
6. Specify a name for the file you want to export and click Next. For example, TokenSigningCert.cer
   Entering a new file name will not impact the setup.
7. Click Finish to export the file.
   A message is displayed stating "The export was successful".
8. Click OK to dismiss the message.
   
9. Close the MMC.

Note:

1. The token-signing certificate is downloaded in .cer format. Since Zoho Desk does not accept certificates in this format, kindly save it to a .txt file.

Step 5 - Configuring for use with Zoho Desk

1. Click on Setup > Channels > Help Center.
2. Select the Help Center in which you want to authenticate users using SAML.
   
3. Click User Authentication under the Help Center sub-menu.
   
4. On the SAML page, provide the following details:
   
• Remote Login URL: Enter the remote login URL as https://sso.yourdomain.tld/adfs/ls
  
• Remote Logout URL: Enter the remote logout URL as https://sso.yourdomain.tld/adfs/ls/?wa=wsignout1.0
  
• Reset Password URL: Enter the reset password URL as https://sso.yourdomain.tld/adfs/ls
  
• Public Key: Upload the base-64 encoded X.509 certificate in the text format. Refer, Step 4. 
  
• Algorithm: RSA is the only option available. (RSA Version SHA-256).
5. Click Save.