Set up SSO with ADFS

Requirements
- Access to the ADFS management console
- Grammarly Business, Grammarly Pro, or a Grammarly for Education account with the admin role or a designated custom role

1. Open the AD FS management tool on your Windows server.
2. Go to Trust Relationships -> Relying Party Trusts.
3. In the Actions tab, click Add Relying Party Trust.
4. Click Start.
5. In the Select Data Source screen, select the last option, Enter Data About the Party Manually, and move on to the next page.
6. Enter the preferred display name (e.g., Grammarly) and continue to the next screen.
7. Choose the AD FS profile option and click Next.
8. Leave the certificate settings at their defaults and proceed to the next step.
9. Check the box labeled Enable Support for the SAML 2.0 WebSSO protocol and enter https://sso.grammarly.com/saml/assertion in the Relying party SAML 2.0 SSO service URL field.
10. On the next screen, enter https://sso.grammarly.com/saml/metadata in the Relying party trust identifier field, click Add, and move on to the next page.
11. Configure multi-factor authentication for Grammarly (optional).
12. On the following page, choose Permit all users to access this relying party.
13. Next, review the chosen settings and move to the final screen to close the wizard. By default, this action will open the Edit Claim Rules window.
14. Click Add Rule and choose Send LDAP Attributes as Claims as a template and configure the rule as follows:
    
    • E-Mail-Addresses -> EmailAddress
    • Given-Name -> FirstName
    • Surname -> LastName
    • E-Mail-Addresses -> E-Mail Address
15. Click Finish to save the rule.
16. Click Add Rule and select Transform an Incoming Claim as the template.
17. On the next page, configure as shown below:
    • Incoming claim type -> E-Mail Address
    • Outgoing claim type -> Name ID
    • Outgoing name ID format -> Email
18. Click Finish to save the second rule and close the Edit Claim Rules window by clicking OK.

Note: User management will be handled in the Active Directory. All Grammarly users should have the following fields filled out: First name, Last name, E-mail. For more information, please see this guide from Microsoft.

Now that the Grammarly relying party trust is active, you will need to pass the following three parameters to Grammarly in order to activate SSO in your account:

1. Identity Provider Issuer
2. SAML 2.0 Endpoint (HTTP)
3. X.509 Certificate

The first two values can be determined depending on your domain:

• Identity Provider Issuer = http://yourdomain.com/adfs/services/trust
• SAML 2.0 Endpoint (HTTP) = https://yourdomain.com/adfs/ls

To locate the X.509 Certificate, please follow these steps:

1. In the AD FS management tool go to Service -> Certificates and open your primary token-signing certificate.
   

   Note: Make sure that the certificate has a private key associated with it. For more information, please see this article from Microsoft.

2. Go to the Details tab and click Copy to File.
3. In the window that opens, click Next and choose No, do not export the private key.
4. On the next page, choose Base-64 encoded X.509 option and click Next.
5. Enter the preferred file name and save location, and click Finish on the next page to complete the export.
6. Open the exported file in a text editor and pass the contents to Grammarly along with the two parameters mentioned above. For more information on how to do this, please see step 2 of this article: Set up SAML single sign-on

If you encounter any issues, please look for a troubleshooting article on this page: Resolve Issues