HCLSoftware Business Partner
Domino Consulting Services
CRUCIAL Notes Tools
+1 212-599-2048

Domino Consulting Services
CRUCIAL Notes Tools
Domino administration
Notes development

Facebook Twitter YouTube
Chat now       
.
ProductsDownloadsNewsAbout usContact


Need a Domino Consultant? Call NotesMail +1 212-599-2048 - HCLSoftware Business Partner

SECURING
Preparing Active Directory Federation Services (ADFS)

If your IdP is Microsoft™ Active Directory Federation Services (ADFS), complete these steps to prepare to use ADFS with Domino. make sure you meet the following requirements before you configure SAML in Domino®.

About this task

These steps are based on ADFS 4.0 and may vary if you use an earlier version.

Procedure

1. Verify that you meet the following requirements:

    • One of the following versions of ADFS installed and configured:
        • 2.0 (Provided with Windows Server 2008 R2)
        • 3.0 (Provided with Windows Server 2012 R2)
        • 4.0 (Provided with Windows Server 2016)
    • A Secure Sockets Layer (SSL) certificate on the ADFS server that is signed by a Certificate Authority (CA). The CA root cert should be deployed by a domain policy to clients, an ADFS best practice.
    • The following components must be in the same Active Directory domain, unless Active Directory trust relationships are in place:
        • ADFS server
        • User records
        • Client computers from which users log in. (Integrated Windows™ Authentication only)
2. Verify that your ADFS server is operational. For steps, see the Microsoft article https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/verify-that-a-federation-server-is-operational.

3. Go to https://<ADFS server hostname>/adfs/ls/IdpInitiatedSignon.aspxand test that a user can log in.

    • If you see the error This page cannot be displayed, enable the IdP sign on page:

        a. In a Windows PowerShell on the ADFS server, run the following command:

          Get-AdfsProperties

        b. See if the line EnableIdpInitiatedSignonPage in the output isFalse:

          EnableIdpInitiatedSignonPage    :False

        c. If the value is False, run the following command to set it toTrue:

          set-ADfsProperties -EnableIdPInitiatedSignonPage $true

        d. Run the following command to confirm the change:

          Get-AdfsProperties

        e. Restart the ADFS service.
    • If you are unable to log in with Internet Explorer, verify that the browser is enabled for Integrated Windows Authentication:

        a. In Internet Options -> Advanced, verify that the security setting Enable Integrated Windows Authentication is checked.

        b. In Internet Options -> Security, click Sites and then Advanced. Add the ADFS server URL (https://<ADFS server>) to the list of websites.

4. Verify that the content of the following two fields match for each user:
    • The Internet address field in the Domino directory Person document.
    • The E-mail field in the user ADFS properties box.

    Note: User login names are not the same as their email addresses, though they can look like email addresses.

Parent topic: Preparing your identity provider