Create an AD FS OAuth Client for Experlogix Smart Flows (AD FS 4.0 or 5.0)

Prerequisites

Before you start, make sure you have:

• Dynamics 365 CE On-premises environment.

• AD FS 4.0 (Windows Server 2016) or AD FS 5.0 (Windows Server 2019+).

• Administrator access to the AD FS server.

• PowerShell access as Administrator.

• The Smart Flows connector URL (redirect URI), provided in the connector setup screen.

Step 1 – Identify the AD FS OAuth endpoints

1. Log on to your AD FS server.

2. Open PowerShell as Administrator.

3. Run the following command to list the OAuth-related endpoints:

   Get-AdfsEndpoint | Where-Object -Property Protocol -Match OAuth
   

4. Take note of the OAuth authorization endpoint and token endpoint.

   These confirm that OAuth is enabled and help validate your AD FS configuration.

Step 2 – Determine the OAuth Base URL

In the Smart Flows connector setup screen, you will see an OAuthBaseUrl field.

• For AD FS, this should point to your AD FS service URL, for example:

https://adfs.yourdomain.com

Step 3 – Create the AD FS OAuth client

1. Still in PowerShell (Administrator), execute the following command to create a new OAuth client:

   Add-AdfsClient `
   -RedirectUri "https://login.demo.smartflows.com/oauth/callback" `
   -Name "Experlogix Smart Flows"
   

2. After running the command, retrieve the newly created client:

   Get-AdfsClient | Where-Object Name -eq "Experlogix Smart Flows"
   

3. Copy the ClientId value — you will need this later.

• Replace the RedirectUri with the exact value shown in the Smart Flows connector UI.

• The Client ID will be generated automatically.

Step 4 – Grant application permissions

Next, grant the client permission to authenticate using OAuth.

1. Run the following command:

   Grant-AdfsApplicationPermission `
   -ClientRoleIdentifier "<ClientId>" `
   -ServerRoleIdentifier "urn:microsoft:adfs:oauth:token"
   

2. Replace with the Client ID retrieved in Step 3 – Create the AD FS OAuth client.

   This allows the Smart Flows connector to request OAuth tokens from AD FS.

Step 5 – Create and retrieve the client secret

1. Generate a client secret for the OAuth client:

   Add-AdfsClientSecret -ClientId "<ClientId>"
   

2. Copy the generated secret value immediately.

   It is shown only once and cannot be retrieved later.

Step 6 – Configure Smart Flows

1. Return to the Smart Flows connector setup screen.

2. Enter:

   • AD FS Client ID → Client ID from Step 3 – Create the AD FS OAuth client.

   • AD FS Client Secret → Secret from Step 5 – Create and retrieve the client secret

   • OAuth Base URL → AD FS service URL.

3. Save the connector configuration.

Step 7 – Validate the connection

• Complete the connector setup wizard.

• Perform a test authentication or trigger a Smart Flow that accesses Dynamics 365 CE.

• Confirm that authentication is successful and data can be retrieved.

Notes & Best Practices

• Ensure HTTPS is correctly configured on AD FS.

• The redirect URI must match exactly (case-sensitive).

• The AD FS service account must be healthy and time-synchronized.

• For production environments, consider:

  • Dedicated AD FS client per environment.

  • Periodic rotation of client secrets.