This guide is for IT Administrators to setup ADFS for integration with Lucidity Software Products
To help understand what benefits are achieved by setting up ADFS, the following summary has been prepared so you can see the difference between an ADFS authenticated system and normal authentication.
The user must be authenticated against the local network domain in order for ADFS to function. The user must have the same username within Active Directly and Lucidity Access so that Lucidity can determine what permissions to give the user when they log in using ADFS. Lucidity still includes a non-domain login option for times when the user wishes to access Lucidity but they are not logged onto the network. |
| Term | Description |
|---|---|
| IdP | Identity Provider, acts as identifying party in federation requests |
| SP | Service Provider, acts as consumer of relayed information in federation requests |
| Relying Party | Microsoft's terminology for SP |
| idp-instance-url | Web-accessible path to ADFS IdP instance. Must be accessible via HTTPS |
Instructions for setup of ADFS can be found in the following video and instructions. You can skip some of this if ADFS is already setup.
Active Directory Certificate Service is required to sign requests made by IIS when authenticating ADFS.
Following instructions in the below video, install ADCS, and create a Certificate Authority for the machine. This will be used to issue certificates later in the process.
Follow instructions between 0:50 to 5:40
Following instructions from 5:40, create a domain name. Enter the idp-instance-url (eg ec2-54-242-69-188.compute-1.amazonaws.com) into the 'Common name' and 'Friendly name' field. The certificate must be issued against the URL that will be used to perform the authentication requests.
Using the Server Roles, install AD DS. Create a test user that will be used later on to test authentication. Ensure the User has username, password, email address and name specified.
Following instructions from 12:00, install ADFS. Install via the AdfsSetup.exe (as shown in the video) which is available for download from http://www.microsoft.com/en-us/download/details.aspx?id=10909. Installing ADFS via the Server Roles screen causes issues where federation metadata not being installed correctly.
Follow the configuration guide in the video, ensuring to that the idp-instance-url matches the friendly name.
Send the url that will be used to authenticate requests to your contact at Lucidity Software. Once setup is complete at our end we will send you a url to be used in the next step
On the ADFS machine, go to the url provided in the previous step in Internet Explorer (url will look like https://simplesamlphp-url/simplesaml/module.php/core/frontpage_federation.php)
When testing: If you receive a certificate error, view the certificate, and then install the certificate to the Trusted Root Authority store. |
Copy the Entity ID URL under the SAML 2.0 SP Metadata section (that matches the authsource configured in the above step) from the URL https://simplesamlphp-url/simplesaml/module.php/core/frontpage_federation.php.
In the ADFS 2.0 console we need to add a relying party.
AD FS 2.0 -> Trust Relationships -> Relying Party Trusts, right click, 'Add Relying Party Trust'.
Using the URL copied above, paste the URL into 'Federation metadata address' field. Complete the Wizard to create the Relying Party.
Click 'Next' through remaining steps in Relying Party wizard
In ADFS console, right-click on the Relying Party created in the above step, and select 'Edit Claim Rules'.
We will add three Claim Rules.
Outbound Claim Rule
Configure an LDAP Claim
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"), query = ";mail,userPrincipalName,displayName;{0}", param = c.Value);
|
Configure Outbound LDAP attributes to be sent. As a minimum, email, UPN and Given Name
Create Custom Rule
c1:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]
&& c2:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant"]
=> add(store = "_OpaqueIdStore", types = ("http://mycompany/internal/sessionid"), query = "{0};{1};{2};{3};{4}", param = "useEntropy", param = c1.Value, param = c1.OriginalIssuer, param = "", param = c2.Value);
|
NB: the URL http://mycompany/internal/sessionid should be written as is, and not substituted.
c:[Type == "http://mycompany/internal/sessionid"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"); |
Navigate to https://simplesamlphp-url/simplesaml/module.php/core/authenticate.php, and click on the appropriate auth source.
If logging performing the test from a non-IE browser or on machine that is not on the ADFS machine's domain, you will be prompted for user credentials.
Enter the details of the user created in step 7.
Possible Issues: