Configure MFA for ADFS
Applies To: AuthPoint Multi-Factor Authentication, AuthPoint Total Identity Security
Active Directory Federation Services (ADFS) is a single sign-on solution for Active Directory that enables users to log in to external systems and applications with their Active Directory credentials. It provides users with a single sign-on experience when they log in to their organization’s web based applications.
With the AuthPoint ADFS agent, you can add multi-factor authentication (MFA) to ADFS for additional security. To do this, you must add an ADFS resource in the AuthPoint management UI and install the ADFS agent on your ADFS server.
To use MFA with ADFS, you must have a primary AuthPoint Gateway installed on your ADFS server. If you have not already installed the AuthPoint Gateway, see About Gateways.
For Active Directory users to use AuthPoint MFA with ADFS, you must keep the default sAMAccountName value for the attribute related to user login when you configure your external identity.
Configure an ADFS Resource
In the AuthPoint management UI:
- From the AuthPoint navigation menu, select Resources.
- Click Add Resource.
The Add Resource page opens.
- From the Type drop-down list, select ADFS.
- In the Name text box, type a descriptive name for the resource.
- Click Save.
- Add the ADFS resource to your existing authentication policies, or add new authentications policies for the ADFS resource. Authentication policies specify which resources users can authenticate to and which authentication methods they can use. For more information, see About AuthPoint Authentication Policies.
Add the ADFS Resource to Your Gateway Configuration
To use MFA with ADFS, you must have the AuthPoint Gateway installed and you must associate your ADFS resource with the AuthPoint Gateway. The AuthPoint Gateway is the point of communication between AuthPoint and your ADFS server.
If you have not already installed the AuthPoint Gateway, see About Gateways.
To add your ADFS resource to the configuration for your AuthPoint Gateway:
- From the AuthPoint navigation menu, select Gateway.
- Click the Name of your Gateway.
- In the ADFS section, from the Select an ADFS resource list, select your ADFS resource.
- Click Save.
You have successfully associated your ADFS resource with your Gateway. The next step is to download and install the ADFS agent.
Download and Install the ADFS Agent
You must download the configuration file for the Gateway that your ADFS resource is associated with, then you must download and install the ADFS agent.
Your Gateway must be installed and available when you install the ADFS agent.
To download and install the ADFS agent:
- From the AuthPoint navigation menu, select Downloads.
- In the ADFS section, click Download Installer. You must have an ADFS resource and your installed Gateway must be version 4.0.0 or higher to download the configuration file.
- Click Download Config to download the configuration file. If you have multiple Gateways, you are prompted to select which Gateway your ADFS resource is associated with.
- Move the ADFS agent and the configuration file to the ADFS server.
- Run the ADFS agent.
You can only install the ADFS agent on the server with your primary Gateway. To install the ADFS agent on a secondary Gateway server, you must make your secondary Gateway the primary Gateway temporarily while you install the ADFS agent.
- Add your ADFS resource to the configuration for your secondary AuthPoint Gateway. For more information on how to add an ADFS resource to a Gateway, go to the Add the ADFS Resource to Your Gateway Configuration section of this help topic.
- Change your secondary Gateway to the primary Gateway so that you can install the ADFS agent. For more information on how to change the primary Gateway, go to Change the Primary Gateway.
- Download and install the ADFS agent on your secondary Gateway server (now the primary Gateway).
- In the AuthPoint management UI, make your original Gateway the primary Gateway again. This is the Gateway that is used to synchronize users from your Active Directory or LDAP database.
Configure Your Server
After you install the ADFS agent, you must enable MFA in ADFS for specific groups. MFA only works for the users that are a member of the ADFS groups that you select and a member of the AuthPoint groups with an authentication policy for your ADFS resource.
The steps to enable MFA for ADFS groups are different based on whether you have a Windows 2012r2 server or a Windows 2016 server.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Open the Administrative Tools.
- Select AD FS Management.
- Select Authentication Policies.
- In the Multi-factor Authentication Methods section, click Edit to configure MFA globally. To configure MFA per relying party, click Manage.
- In the Edit Global Authentication Policy window, click Add.
- In the Select Users or Groups window, type the name of the LDAP group(s) to enable MFA for.
- Click OK.
- In the Edit Global Authentication Policy window, in the additional authentication methods section, select WatchGuard Multi Factor Authentication.
- Click Apply.
After the configuration the AD FS Management will show the users/groups and the authentication method selected.
![Closed](../../../Skins/Default/Stylesheets/Images/transparent.gif)
- Open Administrative Tools;
- Select AD FS Management.
- Select Service > Authentication Methods.
- In the Multi-factor Authentication Methods section, click Edit.
- In the Edit Authentication Methods window, select WatchGuard Multi Factor Authentication. Click Apply.
MFA is now required for users to access ADFS resources. To configure MFA only for specific users, you must create an access control policy for an AD group with those users.
- (Optional) Create an AD group for the users who must use MFA. If you already have a group, you do not have to create another one.
- Select Access Control Policies.
- Click Add Access Control Policy.
The Add Access Control Policy windows opens. - In the Name text box, type Permit everyone but require MFA for specific groups.
- Type a Description.
- Click Add.
The Rule Editor window opens. - In the Rule Editor, configure these settings:
- For Permit, select everyone.
- For Except, select from specific groups.
- At the bottom of the window, click specific and select the Active Directory group(s) that you want to require MFA for.
- Click OK to save the rule.
- Click Add to add another rule.
The Rule Editor window opens. - In the Rule Editor, configure these settings:
- For Permit, select users.
- Below users, select the from specific groups and the and require multi-factor authentication check boxes
- For Except, select from specific groups.
- At the bottom of the window, click specific and select the Active Directory group(s) that you want to require MFA for.
- Click OK to save the rule.
- Select Relying Party Trusts.
- Right-click on a trust and select Edit Access Control Policy.
- Select the policy you just created.
- Click OK. Restart the ADFS service.
Authentication with ADFS
When MFA is configured for ADFS, users must authenticate when they access your organization's web applications. When a user navigates to a web application, they are redirected to the ADFS SSO page where they must provide their AD credentials and authenticate with MFA.
When a user authenticates through ADFS, the user receives a prompt to share their location. This prompt appears even if your AuthPoint account does not use geofence and geokinetics policy objects.
To authenticate through ADFS:
- Navigate to an external web application.
You are redirected to the ADFS SSO page. - In the User name text box, type your user name or email. User names must be formatted as user@domain or domain\user.
- In the Password text box, type your password.
- Click Log in.
- From the Sign-in Options section, select an authentication option and authenticate.
- Push — Approve the push notification that is sent to your phone
- QR Code — Use the AuthPoint mobile app to scan the QR code, then type the verification code shown in the app
- One-Time Password — Type the one-time password for your token
Set a Custom Login Page for ADFS