Advanced Customization of ADFS for Cloud Usage (Part 3 of 4)
Advanced Customization of ADFS for Cloud Usage
Written by Kevin Saye
This is part 3 of a 4 part blog about customizing Microsoft’s ADFS for advanced user scenarios. I will break down this series into the following parts:
| Part 1 – Customizing the Login Page | Customizing the Login Page for advanced features. We will add icons and have automated presentation logic. |
Part 2 – Using Cloud or on Premises MFA |
What changes happen in the claims and how to control where MFA takes place. |
Part 3 – User Certificates |
Enabling enrollment and usage of user certificates for ADFS. |
Part 4 – Expired Passwords |
How to detect and address users with expired passwords. |
Part 3 – User Certificates
Often overlooked but very effective are User Certificates. These certificates are a legitimate form of multi factor by meeting the something you have (certificates) factor.
ADFS has long supported User Certificates and Windows Server has long supported a Certificate Enrollment Website. Combining these two capabilities, we can user certificates as a single or multi factor login method.
To get started, we need to (1) allow the user to request (enroll) for a certificates and (2) allow the user the ability to authenticate with a certificate.
Allow the user to request a certificate
While it is not the purpose of this document to explain certificates services and PKI, we will assume there is an existing Certificate Services exist and that we have installed the certificate enrollment website.
Security WARNING: Most people view certificates as a highly secure capability, as it does not have an expiring password and often are long lived expiration dates. To enable a user to enroll, I strongly suggest you require multi factor, such as a Phone to verify authenticity of the user. To meet these requirements, our setup will require MFA before the user can request a certificate, which is another form of MFA. Also, our demonstration does not have a certificate approver, yet this could be a security control for your solution.
The default Certificate Enrollment Website look like this, enabling a user to request a user cert.
To securely publish the Certificate Server with Windows Server 2012 R2 Web Application Proxy and Windows Server 2012 R2 ADFS, follow these steps:
Identity the Server with the Certificate Services Web Enrollment Role enabled. My server is named: multifactor.kevinsay.scd365.net, which by default required Windows authentication.
Open the AD FS Management Console on the ADFS Server
Click AD FS à Trust Relationships à Relying Party Trust and select Add Non-Claims Aware Relying Party Trust
Specify a Display name, like Certificate WebSite and click next
Specify the Identifier as https://<servername>/certsrv. My identifier is https://multifactor.kevinsay.scd365.net/certsrv/ and click add and next
Select Configure multi-factor authentication settings for this relying party trust and click next
Under Locations select Extranet and click next, next and close
If promoted to edit the claim rules, simply ok this dialog box
If using a different host name for the Certificate Web Server, you will need to run the command “setspn” to register the unique SPN (used by Kerberos) else Web Application Proxy will not be able to find the server.
Use Active Directory Users and Computers to modify the Kerberos Constrained Delegation of the Web Application Proxy to include the SPN of the Certificate Services Web Enrollment Server, as illustrated below:
Open the Remote Access Management Console on the Web Application Proxy Server and select Publish
Select ADFS as the Preauthentication method
Select the name of the Certificate WebSite, as defined in step 4 and click next
Type a name, external URL, select a cert that matches the external name, a backend url and the SPN as shown below:
- Click next and publish
If followed correctly and the pre requisites (including DNS) are setup, you should be able to access the External URL and once prompted for ADFS authentication and Multi-Factor authentication, you can request user certificates.
Allow the user to authenticate with a certificate
To enable users to authenticate with certificates as a single or Multi-Factor authentication, follow these steps:
Open the AD FS Management Console on the ADFS Server
Select AD FS à Authentication Policies and click Edit Global Primary Authentication
If you want to enable Certificates as a single Factor authentication for extranet users, under Extranet click Certificate Authentication
If you want to enable Certificates as a Multi-Factor authentication, click the Multi-Factor Tab and click Certificate Authentication and any other MFA method you have installed. Also determine when MFA is required (users/groups, location and devices) as shown below:
