SSO (SAML)

AD FS

Configure SAML single sign-on with Active Directory Federation Services (AD FS) so your users can sign in to Leexi with their Active Directory credentials.

Who is this for?

Administrators who manage company authentication with an AD FS hosted on Windows Server (2016 or later).

Permissions and licenses

Administrator rights on your Leexi account and on the AD FS server.
License required: depending on your plan, check availability in Settings > Integrations.

This guide is in BETA. If you spot any errors, please report them to support@leexi.ai

Retrieve the Leexi values

Open https://app.leexi.ai/en/settings/security and note the two values in the SSO section:

Leexi's Entity ID (by default https://app.leexi.ai/ followed by your company's unique identifier);
the Reply URL (Assertion Consumer Service): https://api.leexi.ai/users/sso/consume.

Create the relying party trust

On the AD FS server, open AD FS Management, click Relying Party Trusts, then Add Relying Party Trust. Choose Claims aware and click Start.

Then follow the wizard screens:

Select Data Source: choose Enter data about the relying party manually. Leexi does not publish a metadata file to import.
Specify Display Name: enter a name, for example Leexi. This name appears in the AD FS console and on the AD FS sign-in page.
Configure Certificate: leave this screen empty, no encryption certificate is needed, and click Next.
Configure URL: check Enable support for the SAML 2.0 WebSSO protocol and enter Leexi's reply URL https://api.leexi.ai/users/sso/consume in Relying party SAML 2.0 SSO service URL.
Configure Identifiers: paste Leexi's Entity ID in Relying party trust identifier and click Add. Copy the value exactly as shown in Leexi, without adding a trailing slash.
Choose Access Control Policy: choose Permit everyone, or a more restrictive policy depending on your organization (AD group, multi-factor authentication).
Ready to Add Trust: review the summary and click Next, then leave Configure claims issuance policy for this application checked before closing.

Configure the claim rules

Leexi identifies the user through the assertion's Name ID, which must contain their email address. The email must be identical to the one on the Leexi account. Two rules are enough.

In Edit Claim Issuance Policy, click Add Rule and create the first rule:

Claim rule template: Send LDAP Attributes as Claims
Claim rule name: E-mail
Attribute store: Active Directory
LDAP Attribute: E-Mail-Addresses
Outgoing Claim Type: E-Mail Address

Click Finish, then Add Rule to create the second rule:

Claim rule template: Transform an Incoming Claim
Claim rule name: Name ID
Incoming claim type: E-Mail Address
Outgoing claim type: Name ID
Outgoing name ID format: Email
Leave Pass through all claim values selected.

Click Finish, then OK.

Check the relying party trust properties

Right-click the Leexi trust, choose Properties and check the following tabs:

Encryption: no certificate must be set. If a certificate is present, click Remove.
Signature: leave the list empty. Leexi does not sign its authentication requests.
Advanced: Secure hash algorithm set to SHA-256.
Endpoints: a single SAML endpoint of type SAML Assertion Consumer, POST binding, index 0, URL https://api.leexi.ai/users/sso/consume.

Download the AD FS metadata and import it into Leexi

From a browser, open https://<your-adfs-server>/FederationMetadata/2007-06/FederationMetadata.xml (replace <your-adfs-server> with your federation service name, for example adfs.your-company.com) and save the XML file.

Import this file at https://app.leexi.ai/en/settings/security under Metadata certificate (XML). Leexi extracts the AD FS identifier, the sign-in URL and the token-signing certificate from it.

On the Leexi sign-in page, enter the email address of an Active Directory user who already has a Leexi account. Leexi redirects them to AD FS, then signs them in automatically once authentication succeeds.

Sign-in must always start from Leexi: the AD FS-initiated sign-on page is not supported.

Going further

Assertion encryption

AD FS can encrypt SAML assertions with the service provider's public certificate. Leexi does not provide an encryption certificate and therefore cannot decrypt an encrypted assertion: in that case, the SAML response is rejected and sign-in fails without any message on the AD FS side.

The exchanges remain protected in other ways:

the SAML response travels over HTTPS between the user's browser, AD FS and Leexi;
AD FS signs the assertion with its token-signing certificate, and Leexi rejects any response whose signature does not match the imported certificate;
the assertion only contains the user's email address.

To check the configuration with PowerShell on the AD FS server:

Get-AdfsRelyingPartyTrust -Name "Leexi" | Select-Object EncryptionCertificate, SignedSamlRequestsRequired, SamlResponseSignature

The expected result is an empty EncryptionCertificate, SignedSamlRequestsRequired set to False and SamlResponseSignature set to AssertionOnly or MessageAndAssertion. If an encryption certificate was added, disable encryption for this relying party trust only:

Set-AdfsRelyingPartyTrust -TargetName "Leexi" -EncryptClaims $false

Token-signing certificate renewal

Leexi verifies assertion signatures with the certificate contained in the imported metadata file. By default, AD FS automatically renews its token-signing certificate every year (AutoCertificateRollover): it generates the new certificate 20 days before the current one expires and promotes it to primary 5 days later, about 15 days before the expiry date shown in the console. From that switch onward, sign-ins to Leexi fail until the new metadata is imported.

Check the certificate dates in AD FS Management > Service > Certificates, or with PowerShell:

Get-AdfsCertificate -CertificateType Token-Signing | Select-Object IsPrimary, Thumbprint, @{n='NotAfter';e={$_.Certificate.NotAfter}}

As soon as a new certificate is listed as primary (IsPrimary set to True), download the FederationMetadata.xml file again and import it into Leexi. A file downloaded before the switch still contains the old certificate: the import must happen after it.

User provisioning

AD FS does not offer SCIM provisioning: users must exist in Leexi before their first SSO sign-in. Invite them from Settings > Users with the same email address as in Active Directory.

If your directory is synchronized with Microsoft Entra ID (Entra Connect), you can combine authentication through AD FS with Entra's SCIM provisioning described in the Microsoft Entra (SAML + SCIM) guide.

After the steps above, users in your workspace can still sign in with email/password or already via SSO. Once all users have been onboarded and have successfully signed in via SSO, you can enforce SSO across your entire workspace. Only Leexi has the authority to disable this setting, to prevent any unwanted behavior.

Frequently asked questions

Things to watch out for

No certificate must appear in the trust's Encryption tab: an encrypted assertion is rejected by Leexi.
The email sent in the Name ID must exactly match the one on the Leexi account.
A renewal of the AD FS token-signing certificate, which happens about 15 days before its expiry date, requires re-importing the metadata into Leexi.
The AD FS servers' clock must be synchronized (NTP): an assertion issued in the future is refused.
Once SSO is enforced on the workspace, only Leexi can disable this setting.

Previous and next pages

Okta

Configure SAML single sign-on with Okta so your users can sign in to Leexi with their Okta credentials.

Fathom migration

Import your Fathom meeting recordings, transcripts and summaries into Leexi.