Skip to main content

ADFS Extension (2016)

With the ADFS Extension module, you can implement multifactor authentication for the Microsoft ADFS server, adding a second factor to the access gaining process.

In ADFS Extension, you can authenticate with the following authenticators:

Examples of extension deployment

Install and configure ADFS Extension​

Note

Before running the ADFS Extension installation package, add the Active Directory Federation Services (AD FS) role.

  1. Run the installation file located at Axidian Access <version number>/Axidian ADFS Extension/<version number> and follow the steps of the installation wizard.

  2. Create a configuration file named MFAAdapter.json with the following parameters:

    • EANetServerURL — the Core Server address

    • ModeId — the identifier of the authentication method used

      ModeId can have the following values:
      • SMS OTP {EBB6F3FA-A400-45F4-853A-D517D89AC2A3}
      • Storage SMS OTP {3F2C1156-B5AF-4643-BFCB-9816012F3F34}
      • Secured TOTP {F15FD7EC-19EA-4384-846E-A2D0BE149FA2}
      • Email OTP {093F612B-727E-44E7-9C95-095F07CBB94B}
      • Passcode {F696F05D-5466-42b4-BF52-21BEE1CB9529}
      • Software OTP {0FA7FDB4-3652-4B55-B0C0-469A1E9D31F0}
      • Hardware OTP {AD3FBA95-AE99-4773-93A3-6530A29C7556}
      • Hardware TOTP {CEB3FEAF-86ED-4A5A-BD3F-6A7B6E60CA05}
      • Axidian Key Provider {DEEF0CB8-AD2F-4B89-964A-B6C7ECA80C68}
      • Telegram Provider {CA4645CC-5896-485E-A6CA-011FCC20DF1D}
      Example
      {
       "ServerType":"eaNet",
       "EANetServerURL":"https://YourDomainName/am/core/",
       "ModeId":"{0FA7FDB4-3652-4B55-B0C0-469A1E9D31F0}"
      }
      Note

      When using the HTTPS protocol connection, you must install a client certificate on each Core Server.

  3. Run PowerShell as an administrator. To register the adapter, enter the following data:

    • YourPath\MFAAdapter.json — specify your full path to the MFAAdapter.json configuration file created in step 2.
    • In the $typeName variable, in the Version parameter, specify the version number of the ADFS Extension used.
    Important

    When registering, modifying, or removing the adapter, restart the ADFS services on each ADFS server.

    Example
    $typeName = "Axidian.ADFS.MFAAdapter.MFAAdapter, Axidian.ADFS.MFAAdapter, Version=1.0.12.0, Culture=neutral, PublicKeyToken=1ebb0d9282100d91"
    Register-AdfsAuthenticationProvider -TypeName $typeName -Name "MFA Adapter" -ConfigurationFilePath 'YourPath\MFAAdapter.json'

    • To register several providers, change the provider name in the Name parameter.

      Example
      Register-AdfsAuthenticationProvider -TypeName $typeName -Name "MFA Passcode" -ConfigurationFilePath 'YourPath\MFAAdapter.json'

    • Change the display name of the provider. For the Name parameter, specify the value from the previous step; for the DisplayName parameter, specify the name that is displayed during authentication through ADFS.

      Example
      Set-AdfsAuthenticationProviderWebContent -Name "MFA Adapter Passcode" -DisplayName "Passcode"

  4. To remove the adapter, run the following command:

    Unregister-AdfsAuthenticationProvider -Name "MFA Adapter"

  5. To update the configuration, run the following command:

    Import-AdfsAuthenticationProviderConfigurationData -Name "MFA Adapter" -FilePath 'YourPath\MFAAdapter.json'

Enable multifactor authentication for ADFS​

  1. Open the ADFS management console.

  2. Select Service→Authentication Methods.

  3. In the Actions window, select Edit Multi-factor Authentication Methods....

  4. On the Multi-factor tab, select the previously created provider and click Apply.

  5. Restart the AD FS service to apply the changes.

Register an authenticator at the first login to ADFS​

At the first login to ADFS, the user is prompted to specify a phone number in the following cases:

  • The user has no phone number specified in Active Directory.
  • The phone number is specified, but the Use the phone number from Active Directory if the authenticator is not registered policy is disabled.

After specifying the phone number, the user receives a one-time password to that number, which must be entered in the ADFS form to complete the login to the target application.

Switch the Telegram Provider operating mode​

You can log in to ADFS with Telegram Provider either with a one-time password or with a push notification requesting to confirm or reject the login.

To select the login confirmation method, do the following:

  1. In Management Console, in the left menu, select Policies.
  2. From the list of policies, select the policy with the ADFS application added.
  3. In the policy menu on the left, select Applications and go to the ADFS application.
  4. In the Telegram operating mode item, select the authentication method: one-time password or push notification.

Example of the module operation on the ADFS idpinitiatedsignon page​

The example of the extension operation is shown on the idpinitiatedsignon.htm page.

By default, this page is not configured. Configuring this page is optional.

Configuring the test page

  1. Select Relying Party Trusts and click Add Relying Party Trust....

  2. On the Welcome tab, select Claims aware and click Start.

  3. On the Select Data Source tab, specify the URL of your application and click Next.

    Information

    The standard ADFS page idpinitiatedsignon.htm is used as an example of the extension operation. The metadata address for this page is used, for example, https://<full_dns_server_name>/federationmetadata/2007-06/federationmetadata.xml.

  4. On the Specify Display Name tab, enter the name and description for your trust and click Next.

  5. On the Choose Access Control Policy tab, select a suitable policy with an MFA request from the default ones; you can also add arbitrary access control policies.

  6. Leave the other parameters as default.

  7. Restart the ADFS service to apply the changes.

Module operation

By default, the idpinitiatedsignon.htm page is disabled in ADFS 2016. To enable it, run PowerShell as an administrator and execute the following command:

Set-AdfsProperties -EnableIdpInitiatedSignonPage $True

  1. Open the ADFS test page: https://YourDomainName/adfs/ls/idpinitiatedsignon.htm.

  2. Perform the login.

  3. After entering the domain login and password, specify the data for the second authentication factor.

  4. After the correct input, the login is performed.