Microsoft ADFS Authentication

Since Windows Server 2016 the Active Directory Federation Services (ADFS) supports OpenID that we use in this provider.

System Requirement

  • Windows Server 2016 or newer
  • ADFS 3.0

Prepare the ADFS

On the server on with ADFS you need to run the follow powershell command:

  Add-AdfsClient -Name <name> -ClientId <clientid> [[-RedirectUri] <Uri[]> ]
 
  # For example:
  Add-AdfsClient -Name "My App" -ClientId "123456" -RedirectUri @("http://localhost:9000/")

The RedirectUri must be the base location of INETAPP from the view of users.

If you have problems with the browsers Edge and/or Internet Explorer then you can disable the Windows Integrated Authentication (WIA) with the follow powershell command:

  Set-AdfsGlobalAuthenticationPolicy -PrimaryIntranetAuthenticationProvider @('FormsAuthentication', 'MicrosoftPassportAuthentication')

Setup the Authentication

In the configuration manager web interface you need to enter:

  • the host name of the ADFS server. In general this must be an FQDN. You should try if you can establish a HTTPS connection to the root (https://adfs-server.yourcompany.local/) in a browser. You are all set up if you receive a status 404 from this URL.
  • the client ID that you have created with the powershell command.