SafeNet Agent for ADFS

Active Directory Federation Services (ADFS) supports a federated identity management solution extending distributed identification, authentication, and authorization services to web-based applications across organization and platform boundaries.

Multi-Factor Authentication (MFA) has traditionally meant using a smart card or other second factor with Active Directory–based authentication, such as Integrated Windows Authentication. This type of MFA can impose client-side requirements, such as smart card drivers, USB ports, or other client hardware or software that cannot always be expected with Bring Your Own Device (BYOD) client devices. ADFS introduces a pluggable MFA concept focused on integration with the ADFS policy.

Documentation sections

• Installing the agent - Pre-installation checklist, Relying Party Trust, installation, and upgrade
• Configuring the agent - Auth node, agent key file, agent console tabs, server farm, localization, and ADFS policies
• Running the ADFS solution - End-user authentication flows

ADFS authentication concepts

This section describes some important ADFS concepts.

Primary and secondary authentication

Previous versions of ADFS have supported authenticating users against Active Directory using any of the following methods:

• Integrated windows authentication
• Username and password
• Client certificate [client Transport Layer Security (TLS), including smart card authentication]

The above methods are still supported, but are now called "primary authentication" because Microsoft has introduced a new feature called "secondary authentication" or "additional authentication". This is where the SafeNet Agent for ADFS, an MFA plugin, comes in.

Secondary authentication occurs immediately after primary authentication and authenticates the same AD user. Once primary authentication is complete and successful, ADFS invokes the external authentication handler. This handler invokes an additional authentication provider, either an in-box ADFS provider or an external MFA provider, based on protocol inputs and policy. ADFS passes the primary authenticated user's identity to the additional authentication provider, which performs the authentication and hands the result back. At this point, ADFS continues executing the authentication/authorization policy and issues the authenticator accordingly.

Authentication flow

ADFS provides extensible MFA through the concept of additional authentication provider that is invoked during secondary authentication. External providers can be registered in ADFS. Once a provider is registered with ADFS, it is invoked from the ADFS authentication code via specific interfaces and methods that the provider implements and that ADFS calls. Because it provides a bridge between ADFS and an external authentication provider, the external authentication provider is also called an ADFS MFA adapter.

Invoking MFA

There are two ways to configure ADFS to invoke MFA: policy configuration, or via the WS-Federation or SAML protocol authenticator request.

1. Via policy, ADFS introduces a new rule set called Additional Authentication Rules that are used for triggering MFA. As with many other settings in ADFS, you can set these rules at a global level or at the relying party trust level.

2. As part of the new rule set, ADFS introduces a new claim type and value to refer to MFA. When this claim type and value is generated via an additional authentication rule, ADFS will invoke the external authentication handler, and hence the providers configured on the system. If more than one provider is enabled in ADFS, the user will see a method choice page that displays the friendly name of each provider and allows the user to select one by clicking on it.

Authentication management platform

The SafeNet Agent for ADFS supports SafeNet Trusted Access (STA).

Authentication methods

With STA, the agent presents a single authentication method at ADFS sign-in. You choose which one by setting the Default OTP Policy on the agent's Policy tab:

• Push Challenge sends a push notification to the user's MobilePASS+ authenticator.

• Manual Challenge prompts the user for a passcode, which they can obtain from an authenticator app, a hardware token, SMS, email, or a temporary static password. Selecting Pre-Generate Challenge additionally displays the GrIDsure grid.

To use STA, you must also set the agent to its classic variant in the initialization file. See Set the agent variant for STA.

For the end-user experience, see Running the ADFS solution.

System requirements

• Architecture: 64-bit

• Additional software components: Microsoft .NET Framework 4.8

• Authentication methods: All authenticators and authentication methods supported by STA.

• Web browsers:

  • Microsoft Edge (not supported on mobile devices)
  • Mozilla Firefox
  • Google Chrome