Skip to main content

ADFS Extension (2012)

With the ADFS Extension module, you can implement multifactor authentication for the Microsoft ADFS server, adding a second factor to the access gaining process.

In ADFS Extension, you can authenticate with the following authenticators:

Examples of extension deployment:

Install and configure ADFS Extension​

  1. Run the installation file located at Axidian Access <version number>/Axidian ADFS Extension/<version number> and follow the steps of the installation wizard.

  2. Create a configuration file named MFAAdapter.json with the following parameters:

    • EANetServerURL — the Core Server address

    • ModeId — the identifier of the authentication method used

      ModeId can have the following values:
      • SMS OTP {EBB6F3FA-A400-45F4-853A-D517D89AC2A3}
      • Storage SMS OTP {3F2C1156-B5AF-4643-BFCB-9816012F3F34}
      • Secured TOTP {F15FD7EC-19EA-4384-846E-A2D0BE149FA2}
      • Email OTP {093F612B-727E-44E7-9C95-095F07CBB94B}
      • Passcode {F696F05D-5466-42b4-BF52-21BEE1CB9529}
      • Software OTP {0FA7FDB4-3652-4B55-B0C0-469A1E9D31F0}
      • Hardware OTP {AD3FBA95-AE99-4773-93A3-6530A29C7556}
      • Hardware TOTP {CEB3FEAF-86ED-4A5A-BD3F-6A7B6E60CA05}
      • Axidian Key Provider {DEEF0CB8-AD2F-4B89-964A-B6C7ECA80C68}
      • Telegram Provider {CA4645CC-5896-485E-A6CA-011FCC20DF1D}
      Example
      {
       "ServerType":"eaNet",
       "EANetServerURL":"https://YourDomainName/am/core/",
       "ModeId":"{0FA7FDB4-3652-4B55-B0C0-469A1E9D31F0}"
      }
      Note

      When using the HTTPS protocol connection, you must install a client certificate on each Core Server.

  3. Run PowerShell as an administrator. To register the adapter, enter the following data:

    • YourPath\MFAAdapter.json — specify the full path to the MFAAdapter.json configuration file created in step 2.

    • In the $typeName variable, in the Version parameter, specify the version number of the ADFS Extension used.

      Important

      When registering, modifying, or removing the adapter, restart the ADFS services on each ADFS server.

      Example
      $typeName = "Axidian.ADFS.MFAAdapter.MFAAdapter, Axidian.ADFS.MFAAdapter, Version=1.0.6.0, Culture=neutral, PublicKeyToken=1ebb0d9282100d91"
      Register-AdfsAuthenticationProvider -TypeName $typeName -Name "MFA Adapter" -ConfigurationFilePath 'YourPath\MFAAdapter.json'

    • To register several providers, change the provider name in the Name parameter.

      Example
      Register-AdfsAuthenticationProvider -TypeName $typeName -Name "MFA Passcode" -ConfigurationFilePath 'YourPath\MFAAdapter.json'

    • Change the display name of the provider. For the Name parameter, specify the value from the previous step; for the DisplayName parameter, specify the name that is displayed during authentication through ADFS.

      Example
      Set-AdfsAuthenticationProviderWebContent -Name "MFA Adapter Passcode" -DisplayName "Passcode"

  4. To remove the adapter, run the following command:

    Unregister-AdfsAuthenticationProvider -Name "MFA Adapter"

  5. To update the configuration, run the following command:

    Import-AdfsAuthenticationProviderConfigurationData -Name "MFA Adapter" -FilePath 'YourPath\MFAAdapter.json'

Enable multifactor authentication for ADFS​

  1. Open the ADFS management console.

  2. Select Authentication Policies.

  3. In the Actions window, select Edit Global Multi-factor Authentication....

  4. Add a user/group and enable the following parameters:

    • On the Multi-factor tab, in the Location item, select Extranet and Intranet.
    • Select the MFA Adapter provider.

  5. Restart the ADFS service to apply the changes.

Register an authenticator at the first login to ADFS​

At the first login to ADFS, the user is prompted to specify a phone number in the following cases:

  • The user has no phone number specified in Active Directory.
  • The phone number is specified, but the Use the phone number from Active Directory if the authenticator is not registered policy is disabled.

After specifying the phone number, the user receives a one-time password to that number, which must be entered in the ADFS form to complete the login to the target application.

Switch the Telegram Provider operating mode​

You can log in to ADFS with Telegram Provider either with a one-time password or with a push notification requesting to confirm or reject the login.

To select the login confirmation method, do the following:

  1. In Management Console, in the left menu, select Policies.
  2. From the list of policies, select the policy with the ADFS application added.
  3. In the policy menu on the left, select Applications and go to the ADFS application.
  4. In the Telegram operating mode item, select the authentication method: one-time password or push notification.

Example of the module operation on the ADFS idpinitiatedsignon page​

The example of the extension operation is shown on the idpinitiatedsignon.htm page.

By default, this page is not configured. Configuring this page is optional.

Configuring the test page

  1. Select Relying Party Trusts and click Add Relying Party Trust....

  2. On the Welcome tab, select Claims aware and click Start.

  3. On the Select Data Source tab, specify the URL of your application and click Next.

    Information

    The standard ADFS page idpinitiatedsignon.htm is used as an example of the extension operation. The metadata address for this page is used.

  4. On the Specify Display Name tab, enter the name and description for your trust and click Next.

  5. On the Choose Access Control Policy tab, select a suitable policy with an MFA request from the default ones; you can also add arbitrary access control policies.

  6. Leave the other parameters as default.

  7. Restart the ADFS service to apply the changes.

Module operation

  1. Open the ADFS test page: https://YourDomainName/adfs/ls/idpinitiatedsignon.htm.
  2. Perform the login.
  3. After entering the domain login and password, specify the data for the second authentication factor.
  4. After the correct input, the login is performed.