Skip to main content

IIS Extension

With IIS Extension, you can configure two-factor authentication in web applications that use Forms Authentication and are deployed on the Microsoft Internet Information Services (IIS) platform.

Two-factor authentication is supported only for applications that use Forms Authentication.

Two-factor authentication is implemented with authentication by the domain password and by a second factor — a one-time password or a push notification in the Axidian Key application.

In IIS Extension, you can authenticate with the following authenticators:

Examples of IIS Extension deployment:

Prerequisites​

To use the IIS Extension module:

  1. Install Windows Password Provider on the computer with Core Server installed.
  2. When using the HTTPS protocol connection, install a client certificate on each Core Server.
  3. Install and configure IIS Extension.
  4. Configure IIS.
  5. Configure the integration of IIS Extension with the business application.
  6. If required, specify the optional settings.

Install and configure IIS Extension​

To install the module:

  1. Run the Axidian.IIS.Extension-<version number>.x64.en-us.msi installation file located at Axidian Access <version number>/Axidian IIS Extension/<version number> and follow the steps of the installation wizard. If required, you can change the installation folder.

  2. Open Windows Registry Editor.

  3. In the HKEY_LOCAL_MACHINE\SOFTWARE\Axidian-ID\SrvLocator2 section, modify the following parameters:

    • In the ServerUrlBase parameter, specify the URL of your Core Server in the format http(s)://full_dns_server_name/am/core.
    • In the IsIgnoreCertErrors parameter, specify the value 0 or 1. This parameter stands for verifying the server certificate; with the value 1, certificate errors are ignored.

  4. In the HKEY_LOCAL_MACHINE\SOFTWARE\Axidian-ID section, in the IISHTTPModule subsection, create the following parameters:

    • The LSUrl string parameter. In the parameter value, specify the URL of your Log Server in the format http(s)://full_dns_server_name/ls/api.
    • The ProviderId string parameter. This is an optional parameter. In the value, specify the identifier of the provider that becomes the default provider at the first login.
    Possible ProviderId values
    • SMS OTP {EBB6F3FA-A400-45F4-853A-D517D89AC2A3}
    • Email OTP {093F612B-727E-44E7-9C95-095F07CBB94B}
    • Passcode {F696F05D-5466-42b4-BF52-21BEE1CB9529}
    • Software OTP {0FA7FDB4-3652-4B55-B0C0-469A1E9D31F0}
    • Hardware OTP {AD3FBA95-AE99-4773-93A3-6530A29C7556}
    • Hardware TOTP {CEB3FEAF-86ED-4A5A-BD3F-6A7B6E60CA05}
    • Axidian Key (only in the push notification mode) {DEEF0CB8-AD2F-4B89-964A-B6C7ECA80C68}
    • Telegram Provider {CA4645CC-5896-485E-A6CA-011FCC20DF1D}

Configure IIS​

Note

This instruction describes a configuration example for Exchange 2016.

To configure IIS:

  1. In IIS Manager, open the application that will use IIS Extension (for Outlook Web Access, this is owa) and go to the Modules section.

  2. In the Actions menu, click Configure Native Modules, select the Axidian modules, and click OK.

Integrate IIS Extension with a business application​

Two-factor authentication must be configured separately for each target application.

To configure the integration:

  1. Open Windows Registry Editor.

  2. In the HKEY_LOCAL_MACHINE\SOFTWARE\Axidian-ID\IISHTTPModule section, create a section with the name of the application or site in IIS. The value can be arbitrary.

  3. In the created section, create the following parameters:

  • AuthCookie — a string parameter. The name of the cookie used for authentication in the target application. It is determined experimentally for each application. To get the parameter value from the F12 IE Developer Toolbar console:

    1. In the Network section, click Enable network traffic capturing.

    2. Authenticate in the application.

    3. Go to the Details section, to the Cookies tab.

    4. Find the value in the Key column.

  • isMFAEnabled — a DWORD parameter. Enables two-factor authentication.

  • LoginURL — a string parameter. The relative URL that the application login form data is POSTed to. It must start with a slash (/). The URL is specified relative to the target site.

  • MatchTargetRedirect — a DWORD parameter. With the value 1, the page for entering the second factor is displayed before going to the main page. The target page is not saved in the buffer; after the second factor is entered, the transition to the main page occurs (the TargetURL parameter).

  • OTPURL — a string parameter. An alternative URL for sending the second factor authentication form data. By default, the form data is sent to the same URL as the target application form data. The IIS module intercepts it and substitutes the original data if authentication was successful, or does not substitute it if authentication failed and the target application displays its own authentication error. The value must be used if the target application does not treat the form data as erroneous for authentication, or if authentication errors must be shown to the user explicitly. Thus, the value can be left empty.

  • PasswordField — a string parameter. The value of the name attribute of the password field of the application login form.

  • LoginReferer — a string parameter. Allows you to separate requests from applications that use the same login page. Create a parameter with a unique value for each application.

    Important

    If the server address matches the application name, the request source for the login page contains this application name even if you set different LoginReferer values.

    Example

    For example, the server address is ecp.axidian.local. You have configured two LoginReferer values — %2fowa and %2fecp. The login page for both the OWA application and the ECP application will contain the server name part %2fecp.axidian.local.

    To solve this problem, specify the following in LoginReferer:

    • for OWA: %2fecp.axidian.local%2fowa
    • for ECP: %2fecp.axidian.local%2fecp

  • RedirectToTarget — a DWORD parameter. The transition to the target page.

  • TargetURL — a string parameter. The URL of the target page the user gets to after authentication in the application.

    Important

    For Exchange 2013 and 2016, specify /owa (without the trailing slash /); for Exchange 2010, specify /owa/ (with the trailing slash /).

  • UsernameField — a string parameter. The value of the name attribute of the username field of the application login form.

The values of all the parameters — LoginURL, PasswordField, UsernameField — are contained in the authentication form of the target application and can be obtained, for example, with the Internet Explorer F12 Developer Tools.

Note

If you use the OWA application, disable Basic authentication in Registry Editor. Create a DWORD parameter IsBasicDisabled with the value 1 at the following path: HKEY_LOCAL_MACHINE\SOFTWARE\Axidian-ID\IISHTTPModule\IISConfig\owa.

Optional settings​

Example of the module operation​

  1. Open the OWA application and enter the domain login and password.

  2. After the correct input, a window prompting for the second factor appears.

  3. After the one-time password is entered successfully, the application opens.