Knowledge Base - Smart Flows
Knowledge Base - Smart Flows
Breadcrumbs

Create an AD FS OAuth Client for Experlogix Smart Flows (AD FS 3.0)

Prerequisites

Make sure you have:

  • Dynamics 365 CE On-premises.

  • AD FS 3.0 (Windows Server 2012 R2).

  • Local administrator access on the AD FS server.

  • PowerShell opened as Administrator.

  • The Redirect URI shown in the Smart Flows connector screen.

Step 1 – Verify OAuth endpoints on AD FS 3.0

  1. Log on to the AD FS server.

  2. Open PowerShell as Administrator.

  3. Run the following command:

    Get-AdfsEndpoint | Where-Object -Property Protocol -Match OAuth

  4. Confirm that OAuth endpoints are returned.

    This validates that OAuth is enabled on the AD FS instance.

Step 2 – Determine the OAuth Base URL

For AD FS 3.0, the OAuth Base URL must point to your AD FS service URL, for example:

https://adfs.yourdomain.com

Step 3 – Create the AD FS OAuth client

  1. In the same PowerShell (Administrator) session, execute:

    Add-AdfsClient `
-RedirectUri "https://login.demo.smartflows.com/oauth/callback"

  • Replace the RedirectUri with the exact value shown in the Smart Flows connector UI.

  • The Client ID is generated automatically.

Step 4 – Retrieve the Client ID

  1. Run:

    Get-AdfsClient

  2. Identify the newly created client (typically the most recent one).

  3. Copy the value of ClientId.

    This is the only value required for AD FS 3.0.

Step 5 – Grant OAuth token permissions

Grant the client permission to request OAuth tokens:

Grant-AdfsApplicationPermission `
-ClientRoleIdentifier "<ClientId>" `
-ServerRoleIdentifier "urn:microsoft:adfs:oauth:token"

Replace <ClientId> with the value retrieved in Step 4 – Retrieve the Client ID.

Step 6 – Configure the Smart Flows connector

  1. Return to the Smart Flows – Edit connector (AD FS Client) screen.

  2. Enter:

Step 7 – Validate the connection

  • Complete the connector setup wizard.

  • Perform a test authentication or trigger a Smart Flow that accesses Dynamics 365 CE.

  • Confirm that authentication is successful and data can be retrieved.

Notes & Best Practices

  • Ensure HTTPS is correctly configured on AD FS.

  • The redirect URI must match exactly (case-sensitive).

  • The AD FS service account must be healthy and time-synchronized.

  • For production environments, consider:

    • Dedicated AD FS client per environment.

    • Periodic rotation of client secrets.