Identity Provider

The Identity Provider module (formerly SAML IDP) is used to organize multifactor authentication and single sign-on to web applications.

Starting from Axidian Access 8.1.5, the Identity Provider module supports the following protocols:

Important

If you use Axidian Access 8.1.4 or lower, you can find the required information about installing and configuring the module in the Axidian Access 8.1 documentation.

Identity Provider relieves the user of the need to memorize multiple credentials: only one set of credentials is required to access all integrated systems. Authentication is performed centrally on the Identity Provider side.

In Identity Provider, you can authenticate with the following authenticators:

Email OTP
Hardware OTP
Hardware TOTP
Passcode
Secured TOTP
SMS OTP
Software OTP
Storage SMS OTP
Telegram Provider (in the mode of sending one-time passwords and push notifications with login confirmation)
Windows Password
the Axidian Key mobile application (in the mode of sending one-time passwords and push notifications with login confirmation)

Prerequisites

Before installing Identity Provider:

Install .NET 6 on the server.
To do this, run the dotnet-hosting-6.0.10-win.exe utility located at Axidian Access <version number>/Axidian Idp.
Correct operation of Identity Provider is guaranteed only when .NET 6 is used.
Install the required Internet Information Services components.
To do this, run the Axidian.SAML.IIS.Install.MSServer.ps1 script from Axidian Access <version number>/Misc/IISScripts in PowerShell as an administrator.
If the security settings do not allow running the script, open Axidian.SAML.IIS.Install.MSServer.ps1 in Notepad, copy all the commands, and run them in PowerShell as an administrator.

Important

By default, Identity Provider uses Windows authentication. For non-domain scenarios, enable anonymous authentication.

Enable anonymous authentication

In IIS Manager, in the left menu, select Axidian Access → sites → Default Web Site → am → idp and click Authentication.
Enable the Anonymous Authentication option and leave the other options disabled.

Install and configure Identity Provider

To install and configure Identity Provider:

Run Axidian.IDP-<version number>.en-us.msi located at Axidian Access <version number>/Axidian Idp.

By default, a new IDP server certificate is created and installed after the package is installed. The certificate encrypts the data transmitted between Core Server and the end applications, such as Management Console.

The certificate is not intended for establishing an SSL connection.

If the certificate was generated earlier, clear the Create and install a new IDP server certificate check box in the installation wizard window.

Add a binding in the IIS settings:
1. In IIS Manager, in the left menu, select Axidian Access → sites → Default Web Site.
2. Click Bindings in the Actions section of the right menu.
3. Click Add and specify the following parameters in the window that opens:
  - In the Type field, select https.
  - In the Port field, specify 443.
  - In the SSL certificate field, select the web server certificate.
4. Click OK to save the binding.
5. (Optional) If you use Windows Server 2022 or higher, enable the Disable TLS 1.3 over TCP option and then restart IIS.

Note

Identity Provider is a web application that runs on IIS. For security reasons, Identity Provider works only over the HTTPS protocol. Do not change the protocol, as this reduces the connection security.

If you plan to use the HTTP protocol, edit the Web.config file in the C:\inetpub\wwwroot\am\idp folder.

Modify the Web.config file

In the aspNetCore tag, add the following lines:

<environmentVariables>
 <environmentVariable name="ASPNETCORE_ENVIRONMENT" value="Development" />
</environmentVariables>

Result:

<aspNetCore processPath="dotnet" arguments=".\AM.IDP.dll" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" hostingModel="inprocess">
<environmentVariables>
 <environmentVariable name="ASPNETCORE_ENVIRONMENT" value="Development" />
</environmentVariables>
</aspNetCore>

Modify the configuration file

To configure the Identity Provider module:

Open the app-settings.json configuration file located at C:\inetpub\wwwroot\am\idp.
In the AuthenticationServer section, in the Url parameter, specify the Core Server address in the format http(s)://full_dns_server_name/am/core/.
```
"AuthenticationServer": {
  //highlight-grey-next-line
    "Url": "AUTH_SERVER_URL",
    "IsIgnoreCertErrors": false
  }
```
Server address example
```
https://server.test.local/am/core/
```
Important
For correct operation, we recommend that you install a client certificate on each Core Server.
To ignore server certificate errors, change the value of the IsIgnoreCertErrors parameter to true.
In the Server section, in the Url parameter, specify the address for connecting to Log Server in the format http(s)://full_dns_server_name/ls/api.
```
"Server": {
      "Url": "LOG_SERVER_URL"
}
```
Log Server address example
```
https://server.test.local/ls/api/
```

In the LocalIdentityProviderConfiguration section, set the values of the following parameters:

In the SingleSignOnServiceUrl parameter, specify the Identity Provider address in the format http(s)://full_dns_server_name/am/idp/Account/SsoService.

"LocalIdentityProviderConfiguration": {
          "Name": "urn:axidianid:saml_idp",
          //highlight-grey-next-line
          "SingleSignOnServiceUrl": "IDENTITY_PROVIDER_URL/Account/SsoService"

SSO server address example

    https://server.test.local/am/idp/Account/SsoService

In the Thumbprint parameter, specify the thumbprint of the Identity Provider certificate that was generated during the installation.

  "LocalIdentityProviderConfiguration": {
            "LocalCertificates": [
              {
              //highlight-grey-next-line
                "Thumbprint": "YOUR_CERTIFICATE_THUMBPRINT"
              }
            ]
          }

To get the certificate thumbprint, use the following PowerShell request:
Get-Childitem Cert:\LocalMachine\My\ | Where-Object {$_.Subject -eq "CN=idp"}

In the AuthenticationMethods section, delete the unnecessary lines and add the identifiers of the providers you plan to use in the following format:
- In the Name parameter, specify an arbitrary unique value.
- In the Providers parameter, specify the identifier of the provider used.
Identifiers available for Identity Provider
SMS OTP {EBB6F3FA-A400-45F4-853A-D517D89AC2A3}
Storage SMS OTP {3F2C1156-B5AF-4643-BFCB-9816012F3F34}
Email OTP {093F612B-727E-44E7-9C95-095F07CBB94B}
Passcode {F696F05D-5466-42b4-BF52-21BEE1CB9529}
Software OTP {0FA7FDB4-3652-4B55-B0C0-469A1E9D31F0}
Secured TOTP {F15FD7EC-19EA-4384-846E-A2D0BE149FA2}
Hardware OTP {AD3FBA95-AE99-4773-93A3-6530A29C7556}
Hardware TOTP {CEB3FEAF-86ED-4A5A-BD3F-6A7B6E60CA05}
Axidian Key {DEEF0CB8-AD2F-4B89-964A-B6C7ECA80C68}
Windows Password {CF189AF5-01C5-469D-A859-A8F2F41ED153}
Telegram Provider {CA4645CC-5896-485E-A6CA-011FCC20DF1D}
Example of using one provider
```
  "AuthenticationMethods": [
        {
          "Name": "Passcode",
          "Providers": [
            "F696F05D-5466-42b4-BF52-21BEE1CB9529"
          ]
        }
```
Example of using several providers
```
  "AuthenticationMethods": [
       {
          "Name": "HOTP_Passcode",
          "Providers": [
            "AD3FBA95-AE99-4773-93A3-6530A29C7556",
            "F696F05D-5466-42b4-BF52-21BEE1CB9529"
          ]
        }
```
In the SelfService section, set the AllowWinPwdIfAuthMethodsAreNotAvailable parameter to one of the following values:
- If you set the value to true, users can log in to User Console through Identity Provider using Windows Password even if they have no authenticator. This value also allows logging in to User Console with any authenticator, even if it is not specified in the AuthenticationMethods section.
- If you set the value to false, authorization with Windows Password is not available if this authentication method is not present in the AuthenticationMethods section. Logging in to User Console is possible only with the authenticator specified in this section.
Note
If you use authentication both with Windows Password and with a provider, the event log displays the following:
- If Windows Password was entered correctly and the provider incorrectly, a successful login to Identity Provider with Windows Password is registered in the user events.
- If both Windows Password and the provider were entered correctly, a successful login with the provider is registered in the user events.
In the OIDC section, in the CertificateThumbprint parameter, specify the thumbprint of the Identity Provider certificate that was generated during the installation.
To get the certificate thumbprint, use the following PowerShell request:
```
Get-Childitem Cert:\LocalMachine\My\ | Where-Object {$_.Subject -eq "CN=idp"}
```
(Optional) To configure Axidian Access 8.2 to work with Mobile Device Provisioning 9.x and authentication through IDP 8.2, add the following parameters for the urn:axidianid:mobiledeviceprovisioning application in the SAML block:
- SignLogoutResponse with the value true — this parameter is required for the Logout button in the MDP 9.x interface to work correctly; without this setting an error may appear.
- Thumbprint with the thumbprint of the Identity Provider 8.2 certificate.
To get the certificate thumbprint, use the following PowerShell request:
```
Get-ChildItem Cert:\LocalMachine\My\ | Where-Object { $_.Subject -match "CN=idp" }
```
Example
{ "Name": "urn:axidianid:mobiledeviceprovisioning", "SingleLogoutServiceUrl": "https://amcore.axidian-test.com/am/mdp/Account/SLOService", //highlight-grey-next-line "SignLogoutResponse": true, "PartnerCertificates": [ { //highlight-grey-next-line "Thumbprint": "67446E7995669269987637CA26F953D4B9E9F2DC" } ] },
Save the configuration file and restart IIS.

Prerequisites​

Install and configure Identity Provider​

Modify the configuration file​

Prerequisites

Install and configure Identity Provider

Modify the configuration file