Configure the VeridiumID ADFS Server

The purpose of this document is to provide an end-to-end configuration procedure of an ADFS server along with the Veridium ADFS plugin. This article assumes you already have in place an Active Directory domain and a ADFS dedicated machine joined to this domain

Install ADFS server role and configure the ADFS service

1. The first step is to install the ADFS role. For this, click on Start, then select Server Manager:

   

2. In the SERVER MANAGER window click on Add roles and features:

   

3. In the following window click on Next:

   

4. In the Select installation type window, click on Next:

   

5. In the Select destination server click on Next:

   

6. In the Select server roles window tick the box next to Active Directory Federation Services and then click Next:

   

7. In the Select features window click Next:

   

8. In the following window click Next:

   

9. In the Confirm installation selections window click on Install:

   

10. In this step you can choose either to wait for the installation to complete or click on Close. The installation will complete in the background if you close the window.

    

11. After the installation completes. go to Server Manager and click on the yellow exclamation mark on the upper right side of the window, then select Configure the federation service on this server:

    

12. In the Active Directory Federation Services Configuration Wizard select Create the first federation server in a federation server farm then click on Next:

    

13. Specify a domain account with administrator permissions and then click on Next:

    

14. Click on Import and select a SSL certificate, then set a Federation Service Name to match the certificate and then set the Federation Service Display Name which will appear in the ADFS authentication window:

    

15. If this is the first time you are configuring an ADFS server in your domain, you’ll most likely see this message. Click on Show more:

    

16. A window will appear displaying a command that needs to be executed in order to set the KDS Root Key. Open an elevated PowerShell window and execute the command(Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)):

    

17. After the command has been executed, close the Powershell window:

    

18. Return to the configuration wizard. If the warning hasn’t disappeared, click on Previous and then on Next:

    

19. Select Create a Group Managed Service Account and assign an Account Name, then click on Next:

    

20. Select Create a database on this server using Windows Internal Database then click Next:

    

21. Review the options and then click on Next:

    

22. Wait for the Pre-requisite Checks to complete and then click on Configure:

    

23. After the configuration process is complete, click on Close:

    

Install and configure the Veridium ADFS plugin

1. Install the VeridiumAdfsInstaller_x64.msi by following the instructions on the screen (no special configuration required).

2. Click on Start, then select VeridiumID ADFS Config:

   

3. The first step requires importing a friend certificate for the VeridiumID server which will be integrated with the plugin. For this, go to Veridium dashboard, click on Settings, then scroll down to the Certificates section, click on Service Credentials and then on Custom Services:

   

4. Click on Create Custom Service Certificate:

   

5. Type in a name for the ADFS friend certificate and then click on Create Device:

   

6. Copy the certificate to the ADFS machine, then return to VeridiumID ADFS Configuration and click on Import new:

   

7. Browse to the location where you saved the certificate, select it then type in the password and click Import:

   

8. Next click on VeridiumID FQDN:

   

9. Type in the FQDN of the VeridiumID server you want to use and then click on OK:

   

10. Type in the VFACE Script URL. This can be obtained by concatenating the Shibboleth url and “/idp/custom/vface/vface-web.iife.js“:

    

11. Next go to Veridium Manager and extract the vface license. For this, click on Settings, then Advanced, scroll down and select vface.json:

    

12. Copy the value from the license tag:

    

13. Go back to the VeridiumID ADFS Configuration and paste the copied value in the VFACE license key field:

    

14. Next you need to retrive the signing keystore from the VeridiumID server. For this, go back to Veridium Manager, click on Settings, then scroll down to the Certificates section, click on Signing Keystore and double click the item on the right side:

    

15. Scroll down and click on the Copy button next to Pub Key Base 64:

    

16. Return to the VeridiumID ADFS Configuration and click on Edit JWT key:

    

17. Paste the JWT Signing key value and click on OK:

    

18. Adjust the Session pooling URL to match your idp:

    

19. Click on Register IdP button to apply the settings:

    

Install ClaimsXray to visualize the claims

1. Install ClaimsXray by using the attached Powershell script. Execute it from an elevated Powershell window

   

2. Select the following options and click on Apply changes:

   

3. This will create the ClaimsXray relying party trust, as can be seen by going to Relying Party Trusts container:

   

4. The default ClaimsXray endpoints are no longer available, so you need to change them. For this, right-click the relying party and select Properties:

   

5. In the next window, click on Endpoints tab, replace WS-Federation Passive Endpoints and SAML Assertion Consumer Endpoints with https://claimsxray.net/api/sso and then click on Apply and Ok:

   

6. In order to test you need to enable idpinitiatedsignon page. For this, open an elevated Powershell window and execute the following command:

   CODE

   Set-AdfsProperties -EnableIdpInitiatedSignonPage $true

7. Next you must enable Veridium as authentication method in ADFS service configuration. For this, click on Authentication Methods, then click on the Edit button next to Additional Authentication Methods:

   

8. In the next window select Veridium and then click on Apply:

   

9. Click on Primary, then select Allow additional authentication providers as primary, then click on OK in AD FS Management window:

   

10. Click on Apply and OK, then re-open the Edit Authentication Methods window.

11. Veridium should be visible as an authentication method and you have to enable it:

    

12. Click on Apply and OK to save.

13. Now you can test the authentication by accessing the idp initiated signon page. The url is like this: https://<adfs-fqdn>/adfs/ls/idpinitiatedsignon. Select Sign in to one of the following sites and then click on Sign In:

    

14. Type in your username and the click Next:

    

15. Click on VeridiumID to login using the VeridiumID ADFS plugin:

    

16. Authenticate using the method of your choice:

    

17. After the authentication is complete, you should see a ClaimsXray page like this:

    

Create custom claims

1. With ClaimsXray you can view all the sent claims along with the custom ones. In order to define the actual custom claims, in the ADFS configuration interface click on Claims Descriptions, then Add Claim Description:

   

   NOTE: You can find the custom claims definition in

C:\Program Files\VeridiumID\VeridiumAdfs\lib\VeridiumIdP.dll.config, under CustomClaim<x>_Name/Value keys:

2. In the next window type in country for Display Name and Short Name, then http://schemas.xmlsoap.org/ws/2005/05/identity/claims/country for Claim identifier and select the two publishing options below then click on OK:

   

3. Repeat the steps for countryCode claim: type in countryCode for Display Name and Short Name, then http://schemas.xmlsoap.org/ws/2005/05/identity/claims/countryCode for Claim identifier and select the two publishing options below then click on OK:

   

4. Same for ILPContextScore claim: type in ILP Context Score for Display Name and ILPContextScore for Short Name, then http://schemas.xmlsoap.org/ws/2005/05/identity/claims/ilpContextScore for Claim identifier and select the two publishing options below then click on OK:

   

5. Repeat also for ILPMotionScore claim: type in ILP Motion Score for Display Name and ILPMotionScore for Short Name, then http://schemas.xmlsoap.org/ws/2005/05/identity/claims/ilpMotionScore for Claim identifier and select the two publishing options below then click on OK:

Add claim rules for the Active Directory Claims Provider Trust

1. After adding the custom claims descriptions, you need to add claim rules for the Active Directory Claims Providers Trust. For this, you must click on Claims Providers Trusts, then right-click on Active Directory and select Edit Claim Rules:

   

2. In the next window click on Add Rule:

   

3. In the next window, select Transform an Incoming Claim then click Next:

   

4. Type in country in the Claim rule name field, then select country from the Incoming and Outgoing claim type drop-down list, then select Pass through all claim values and click on Finish:

   

5. Repeat steps 3 and 4 in order to configure a rule for the CountryCode claim as follows:

   

6. Create a new rule by selecting the Pass Through or Filter an Incoming Claim template, then click Next:

   

7. Set the name to ILP Context Score, then select ILP Context Score in the Incoming claim type field, make sure Pass through all claim values is selected and then click on Finish:

   

8. Repeat steps 6 and 7 in order to configure a rule for the claim as follows:

   

Add custom claims to the Veridium ADFS plugin config

• The Veridium ADFS plugin configuration file is located in the install path under the lib folder - e.g. C:\Program Files\VeridiumID\VeridiumAdfs\lib and it is called VeridiumIDP.dll.config. Edit this file and scroll until you find the CustomClaims section. You will find two custom claims already defined here:

You can add the two extra claims defined in the previous section by appending

<add key="CustomClaim3_Name" value="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/ilpContextScore" />
    <add key="CustomClaim3_Value" value="uba_context.score" />
    <add key="CustomClaim4_Name" value="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/ilpMotionScore" />
    <add key="CustomClaim4_Value" value="uba_motion.score" />

after the existing claims. In order for the claims to be processed, you need to change the value of the CustomClaimsCount key to 4 (or how many you need). In the end, the configuration should look like this:

• Save the file and then open the VeridiumID ADFS Config tool. Click on the Register IdP button to apply the custom claims configuration:

  

• Test the configuration by accessing the idpinitiatedsignon page, that is https://<adfs fqdn>/adfs/ls/idpinitiatedsignon. Select Sign in to one of the following sites: then select ClaimsXray from the drop-down list and click on Sign In:

  

• In the next window enter a valid username and click Next:

  

• Click on VeridiumID to authenticate using the Veridium ADFS plugin:

  

• Authenticate using one of the presented options:

  

• After the authentication completes, you should be able to see, among other claims, the custom ones previously defined: