Set Up Enterprise Sign-In Using ADFS 2.0
Your organization can easily manage thousands of users and their product access while also delivering Single Sign-On (SSO). SSO ensures your users can access their LogMeIn products using the same identity provider as for their other enterprise applications and environments. These capabilities are called Enterprise Sign-In.
This document covers configuration of your Active Directory Federation Services (ADFS) to support Single Sign-On authentication to LogMeIn products. Prior to implementing, however, be sure to read more about Enterprise Sign-In and complete the initial setup steps.
ADFS 2.0 is a downloadable component for Windows Server 2008 and 2008 R2. It is simple to deploy, but there are several configuration steps that need specific strings, certificates, URLs, etc. ADFS 3.0 is also supported for Enterprise Sign-In. ADFS 3.0 has several improvements, the largest of which is that Microsoft's Internet Information Services (IIS) Server is included in the deployment rather than a separate install.
Step #1: Federation service certificate
Each ADFS deployment is identified by a DNS name (e.g., “adfs.mydomain.com). You will need a Certificate issued to this Subject Name before you begin. This identifier is an externally visible name, so make sure you pick something suitable to represent your company to partners. Also, don’t use this name as a server host name as well – it will cause trouble with Service Principal Names (SPN) registration if you do.
There are many methods to generate certificates. The easiest, if you have a Certificate Authority in your Domain, is to use the IIS 7 management console:
- Open Web Server (IIS) management snap-in.
- Select the server node in the navigation tree, then Server Certificates option.
- Select Create Domain Certificate.
- Enter your Federation Service Name in Common Name (e.g., adfs.mydomain.com).
- Select your Active Directory Certificate Authority.
- Enter a “Friendly Name” for the Certificate (any identifier will do).
Step #2: Create a domain user account
ADFS servers require that you create a domain user account to run its services (no specific groups are required).
Step #3: Install your first ADFS server
- Download ADFS 2.0 and run the installer. Make sure you run the installer as a Domain Admin – it will create SPNs and other containers in AD.
- In Server Role, select Federation Server.
- Check Start the ADFS 2.0 Management snap-in when this wizard closes at the end of the Wizard.
- In ADFS Management snap-in, click Create new Federation Service.
- Select New Federation Server farm.
- Select the Certificate you’ve created in the previous step.
- Select the Domain user you’ve created in previous steps.
In this step you will tell ADFS the kind of SAML tokens that the system accepts.
Set up the trust relationship, as follows:
- In ADFS 2.0 MMC, select Trust Relationships | Relying Party Trusts in the navigation tree.
- Choose Add Relying Party Trust and click Start.
- In Select Data Source, select Import data about the relying party published online or on a local area network and in the textbox below the selected option paste the metadata URL: https://authentication.logmeininc.com/saml/sp. Click Next.
- Click OK to acknowledge that some metadata that AD FS 2.0 does not understand will be skipped.
- On the Specify Display Name page, type LogMeInTrust, and click Next.
- On the Choose Issuance Authorization Rules screen, choose the Permit all users to access this relying party unless another option is desired.
- Step through the rest of the prompts to complete this side of the trust relationship.
Next, add 2 claim rules, as follows:
- Click on the new endpoint entry, and click Edit Claim Rules on the right.
- Select the Issuance Transform Rules tab and click Add Rule.
- Select Send LDAP Attributes as Claims from the drop-down menu and click Next. Use the following settings for the rule:
- Claim rule name - AD Email
- Attribute store - Active Directory
- LDAP Attribute - E-mail-Addresses
- Outgoing Claim Type - E-mail Address
- Click Finish.
- Click Add Rule again.
- Select Transform an Incoming Claim from the drop-down menu and click Next. Use the following settings for the rule:
- Claim rule name - Name ID
- Incoming claim type - E-Mail Address
- Outgoing claim type - Name ID
- Outgoing name ID Format - Email
- Select Pass through all claim values.
- Click Finish.
Complete the configuration, as follows:
- Right-click on the new relying party trust in the Relying Party Trusts folder and select Properties.
- In Advanced, select SHA-1 and click OK.
- To prevent ADFS from sending encrypted assertions by default, open a Windows Power Shell command prompt and run the following command:
set-ADFSRelyingPartyTrust –TargetName"<relyingPartyTrustDisplayName>" –EncryptClaims $False
The last configuration step is to accept the SAML tokens generated by your new AD FS service.
- Use the “Identity Provider” section in the Organization Center to add the needed details.
- For ADFS 2.0, select “Automatic” configuration and enter the following URL – replacing “server” with the externally accessible hostname of your ADFS server:
Step #6: Test single server configuration
At this point you should be able to test the configuration. You must create a DNS entry for the AD FS service identity, pointing to the AD FS server you’ve just configured, or a network load balancer if you’re using one.
- To test Identity Provider-Initiated Sign-On, go to your custom IdP URL (example: https://adfs.<my domain.com>/adfs/ls/<IdP Initiated sign on> = https://adfs.mydomain.com/adfs/ls/IdpInitiatedSignOn.aspx). You should see the relying party identifier in a combobox under “Sign in to one to the following sites”.
- To test Relying Party-Initiated Sign-on, go to the product login page for the product you wish to sign into (such as www.gotomeeting.com) and on the sign in page, click the “Use my company ID” option. After entering your email address, you should be redirected to the ADFS server and be prompted to log in (or if Windows Integrated Auth is used, you should be automatically logged in to GoToMeeting, GoToWebinar, GoToTraining or OpenVoice).