ADFS Quick Setup Guide - DAM v4.6.1
- Emilis Bliudzius (Unlicensed)
- Mathias Mattson (MHM)
- Former user (Deleted)
1 Overview
ADFS is designed to handle situations where you want to use SSO but your server is not in the same hosting environment as the domain the user is in.
One big difference between ADFS and normal AD is that AD is a user database you are able to query for different information. ADFS is not a user database and normally you don't have access to query it for information. It delivers it's information via clams that is configured beforehand.
Seen from the top there are 2 different ways that an ADFS configuration can be accessed by:
- Active
- The server is able to communicate directly with the ADFS server. This gives the possibility to make logins without http redirects to the ADFS server. (Not implemented at the moment.)
- Passive
- The server is not able to communicate with the ADFS server. So the only way to do logins is via http redirects to the ADFS server (on the client) and reading the security token the ADFS server returns when it redirects back.
You can find more information here: https://blogs.technet.microsoft.com/askpfeplat/2014/08/24/ADFS-deep-dive-primer/
At the moment we only support ADFS with the following products:
- Videoportal
- Media manager
- Digizuite DAM center
- Office Connector
Note: This is a quick guide for ADFS configuration of Digizuite products.
2 ADFS server
In the ADFS server create a Relying Party Trust for every site that ADFS should work on. Under every of these Relying Party Trusts define what data needs to be send in the security token. At the moment, the implementation supports:
- GivenName
- Role
- GroupSid
- Group
For configuration on Digizuite's servers we need the following certificates.
- Token-decryption
- Token-signing
3 Webserver config
The Token-Decrypting certificate needs to be installed in the following place:
- Cert:\\LocalMachine\My Certificate store
The Token-Signing certificate needs to be installed in the following places:
- Cert:\\LocalMachine\My Certificate store
- Cert:\\LocalMachine\TrustedPeople Certificate store
3.1 Videoportal/ Media manager config
In the supplied web.config there is some ADFS parts that needs to be changed.
- <allow users="*" /> — should be removed
- <!-- ADFS deny users="?" /--> — needs to be changed to <deny users="?"/>
- All instances of digiadtest01.cloudapp.net needs to be changed to the correct ADFS servers dns name.
- In the section trustedIssuers change the thumbprint to the correct thumbprints from Token-decryption and Token-signing.
- Be aware that in some cases an unshown character might be copied with the thumbprint if you copy from Powershell. That need to be removed.
- In the section audienceUris make certain that all URLs where a user needs to be redirected to the ADFS server is noted. Normally only the main URL for the site Is needed here.
- In the section wsFederation change realm to the precise same as Relying party in the ADFS server.
- Change domain on cookieHandler.
3.2 Digizuite DAM center config
In the supplied web.config there is some ADFS parts that needs to be changed.
- <allow users="*" /> — Should be removed
- <!-- ADFS deny users="?" /--> — Needs to be changed to <deny users="?"/>
- Change <!-- ADFS add to "<add" and change "/-->" to ">" In the modules part.
- Change <!-- ADFS add to "<add" and change "/-->" to ">" In the bottom of the web.config file.
- All instances of digiadtest01.cloudapp.net needs to be changed to the correct ADFS servers DNS name.
- In the section audienceUris make certain that all urls where a user needs to be redirected to the ADFS server is noted. Normally only the main URL for the site Is needed here.
- You need to add all url's that need ADFS also frontends.
- You need to add all url's that need ADFS also frontends.
- In the section wsFederation change realm to the precise the same as relying party in the ADFS server.
- Change domain on cookieHandler.
3.3 Office Connector config
You need to do the following as seen in the picture.
- Check Use single signon
- In Single signon URL write: https://[DAM]/dmm3bwsv3/ADFSConnect.svc
- In ADFS server write the DNS for ADFS server
Make sure that the endpoint: ADFS/services/trust/2005/windowstransport is enabled in the ADFS server configuration.
4 Tips & Tricks
- Sometimes it might be necessary to change certificateValidationMode from PeerOrChainTrust to None or to NoCheck.
- It is important to have the Application Pool set to Load User Profile. See: https://social.msdn.microsoft.com/Forums/vstudio/en-US/ad1f7367-7727-4b1a-a190-840ff4ed5709/ADFS-20-sso-the-data-protection-operation-was-unsuccessful?forum=Geneva+
- Configuration of group relationships is handled via bind name as in normal AD configuration for the Digizuite.
- If the Office Connector give an exception with "No version of the CardSpace service was found to be installed on the machine.", don't install it. The exception is because the communication with the ADFS server failed and have nothing to do with CardSpace.
Table of Contents