Active Directory Federation Services (ADFS)

kimai:
    saml:
        provider: microsoft
        activate: true 
        title: Login with ADFS
        mapping:            
            - { saml: $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, kimai: email }
            - { saml: $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, kimai: username }
            - { saml: $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname, kimai: alias }
            - { saml: $http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name, kimai: title }
        roles:
            resetOnLogin: true
            attribute: $http://schemas.xmlsoap.org/claims/Group
            mapping:
                # Insert your role-mapping here (ROLE_USER is added automatically)
                - { saml: Admin, kimai: ROLE_SUPER_ADMIN }
                - { saml: Manager, kimai: ROLE_ADMIN }
                - { saml: Teamlead, kimai: ROLE_TEAMLEAD }
        connection:
            idp:
                entityId: 'https://adfs.com/adfs/services/trust'
                singleSignOnService:
                #    binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
                    url: 'https://adfs.com/adfs/ls/'
                singleLogoutService:
                    url: 'https://adfs.com/adfs/ls/?wa=wsignout1.0'
                #    binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
                x509cert: 'CERT'
            # Your Kimai: replace https://www.example.com with your base URL
            sp:
                entityId: 'https://timetracking.example.com/auth/saml/metadata'
                assertionConsumerService:
                    url: 'https://timetracking.example.com/auth/saml/acs'
                #    binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
                singleLogoutService:
                    url: 'https://timetracking.example.com/auth/saml/logout'
                #    binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
                privateKey: ''
            # only set baseurl, if auto-detection doesn't work
            baseurl: 'https://timetracking.example.com/auth/saml/'
            strict: false
            debug: true
            security:
                nameIdEncrypted: true
                authnRequestsSigned: false
                logoutRequestSigned: false
                logoutResponseSigned: false
                wantMessagesSigned: false
                wantAssertionsSigned: false
                wantNameIdEncrypted: false
                requestedAuthnContext: true 
                signMetadata: false
                wantXMLValidation: true
                #signatureAlgorithm: 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
                #digestAlgorithm: 'http://www.w3.org/2001/04/xmlenc#sha256'
                #ADFS URL-Encodes SAML data as lowercase, and the toolkit by default uses
                #uppercase. Turn it True for ADFS compatibility on signature verification
                #https://github.com/SAML-Toolkits/php-saml#how-it-works
                lowercaseUrlencoding: true
            contactPerson:
                technical:
                    givenName: 'Name'
                    emailAddress: 'support@example.com'
            organization:
                en:
                    name: 'Company'
                    displayname: 'Name'
                    url: 'https://example.com'