Versions Compared

Old Version 1

changes.mady.by.user Vladislav Fomichev

Saved on

compared with

New Version 2

changes.mady.by.user Vladislav Fomichev

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

The latter implements a provider of multi-factor authentication for Microsoft ADFS server, thus adding the second factor to the access gaining process.

Information

Files of Indeed ADFS Extension reside in: indeed AM\Indeed ADFS Extension\<Version number>\

Installation and configuration of ADFS Extension

  1. Install Indeed ADFS Extension by running IndeedId.ADFS. Extension-x64.ru-ru.msi installer. 
  2. Create a configuration file named MFAAdapter.json with the following parameters.
  3. Run PowerShell as administrator. Enter the following data to register an adapter:

Information

YourPatch\MFAAdapter.json - specify full path to the previously created configuration file.

Information

Specify the version number of Indeed ADFS Extension used in  $typeName variable, Version parameter.

  1. To remove an adapter, execute the following command:
  2. To update configuration, execute the following command:

Activation of multi-factor authentication for ADFS.

  1. Open AD FS management console.
  2. Select “Authentication methods service”, and then select “Modify methods of multi-factor authentication...” in “Actions” window.
  3. Select the previously created provider at the “Multi-factor” tab and click “Apply”.
  4. Select  "Relying party trust” and click “Add relying party trust...”.
  5. Select “Supporting claims” at the “Welcome!” tab and click “Run”. 
  6. Specify the URL of your server at the “Select Data Source” tab and click “Next”.

Information

The standard ADFS idpinitiatedsignon.htm page is used as extension example. This page uses metadata address.

  1. Enter the name and description for your relying party trust at the “Displayed name” tab and click “Next”.
  2. Select corresponding policy with MFA request in the list of default ones at the “Select access control policy”. You can also add an access control policy of your choice.
  3. Leave all the other parameters with their default values.
  4. Restart the AD FS service to apply the changes.


Example of extension operation.

 Information

The idpinitiatedsignon.htm page is deactivated in AD FS 2016 by default. To activate it, run PowerShell as administrator and execute the following command:

  1. Open ADFS test page: https://YourDomainName/adfs/ls/idpinitiatedsignon. htm
  2. Perform logging in.
  3. Specify the second factor data after entering the username and password.

 4. If all data is entered correctly, log in is executed.