ADFS for. LogMeIn and join.me authentication

Transcription

1 ADFS for LogMeIn and join.me authentication

2 ADFS for join.me authentication This step-by-step guide walks you through the process of configuring ADFS for join.me authentication. Set-up Overview 1) Prerequisite: Verification of Domain Ownership 2) Prerequisite: Set up ADFS 3) Prerequisite: Provide Data to LogMeIn 4) Add LogMeIn as a Relying Party Trust 5) Add the Transform Claim Rule 6) Configure Authorization through AD Group Membership a) Set Authorization Limits 7) Configure NTLM Pass-through for One-click Login Copyright 2013 LogMeIn, Inc. 1

3 1 Prerequisite: Verification of Domain Ownership You must prove ownership of your domain before a LogMeIn representative is permitted to activate ADFS for your domain. Activation can happen before or after set-up. Options for confirmation of domain ownership Option HTML upload DNS record Input or Action Upload a file with the following name to the web site for your planned ADFS domain: logmein-domain-confirmation.html The file must contain a random string provided by your LogMeIn representative. Example: Create a file yourdomain.com/logmein_domain_confirmation.html with content xoivzliaxrltmawrykyjjoauyheiiqge Confirmation procedure: Your LogMeIn representative opens yourdomain.com/logmein_domain_confirmation.html and ensures that the random string is present Create a TXT record for the DNS entry of your domain. The value of the record should be: logmein-domain-confirmation Append the random string provided by your LogMeIn representative. Example: logmein-domain-confirmation jska jkdhkkjdhask Confirmation procedure: Your LogMeIn representative runs nslookup q=txt yourdomain.com and confirms that the random string is present 2 Prerequisite: Set up ADFS Microsoft Active Directory Federation Services (ADFS) is a software module that can be installed on Windows Server operating systems to provide users with Single Sign-On access to systems and applications located across organizational boundaries. By configuring ADFS for join.me authentication you will enable users to log in to join.me using their corporate AD credentials. To simplify provisioning, the first time a user logs in a join.me account for that user is created automatically. Additionally, once configured, ADFS becomes the exclusive authentication method for your domain, which gives you complete control over who can access join.me. The result is a secure authentication methodology that simplifies and automates user provisioning. Copyright 2013 LogMeIn, Inc. 2

4 Before enabling ADFS for join.me authentication, a live ADFS environment with an externally addressable ADFS server must be configured. For assistance setting up ADFS, please consult Microsoft documentation on Technet: Once installed, follow this path to launch AD FS 2.0 Management: Start > Administrative Tools > AD FS 2.0 Management. Copyright 2013 LogMeIn, Inc. 3

5 3 Prerequisite: Provide Data to LogMeIn You must provide the following information to your LogMeIn representative. These are technical requirements that must be met before LogMeIn can enable ADFS for your account: The URL of your ADFS proxy server The domain(s) that you will use for ADFS login (see Add the Transform Claim Rule ) The token signing certificate from your ADFS server To export your token signing certificate, follow the step-by-step instructions in Export the public key portion of a token-signing certificate on Technet: Copyright 2013 LogMeIn, Inc. 4

6 4 Add LogMeIn as a Relying Party Trust You must add LogMeIn as a Relying Party Trust via the Add Relying Party Trust Wizard. 1. In AD FS 2.0 Management, open the Add Relying Party Trust Wizard: Action > Add Relying Party Trust. 2. Input all data in the wizard as shown in the table below. Add Relying Party Trust Wizard Tab Select Data Source Specify a Display Name Choose Profile Configure URL Configure Identifiers Choose Issuance Authorization Rules Ready to Add Trust Finish Input or Action Select Enter data about the relying party manually Enter the Display name as LogMeIn authentication. Select AD FS 1.0 and 1.1 profile Enter the WS-Federation Passive URL: Verify that has been added to the list of Relying party trust identifiers Select Permit all users to access this relying party Select Open the Edit Claim Rules Confirm all data. Copyright 2013 LogMeIn, Inc. 5

7 5 Add the Transform Claim Rule You must add a Transform Claim Rule for LogMeIn using the Add Transform Claim Rule Wizard. 1. In AD FS 2.0 Management, open the Add Transform Claim Rule Wizard: Action > Edit Claim Rules > Issuance Transform Rules > Add Rule. 2. Input all data in the wizard as shown in the table below. Add Transform Claim Rule Wizard Tab Choose Rule Type Input or Action Under Claim rule template select Send LDAP Attributes as Claims Set Claim rule name to and name Set Attribute store to Active Directory Map the LDAP Attributes as follows: -Addresses: Address Given-Name: Given Name Surname: Surname Copyright 2013 LogMeIn, Inc. 6

8 6 Configure Authorization through AD Group Membership Optional. To control access to join.me when authenticating via ADFS access you can add a new Issuance Transform Rule using the Add Transform Claim Rule wizard. 1. In AD FS 2.0 Management, open the Add Transform Claim Rule Wizard: Action > Edit Claim Rules > Issuance Transform Rules > Add Rule. 2. Input all data in the wizard as shown in the table below. Add Transform Claim Rule Wizard Tab Choose Rule Type Input or Action Under Claim rule template select Send Group Membership as a Claim Under Claim rule name, enter a name, for example Permit Group for LogMeIn Browse for a User s group that you want to permit to use LogMeIn services. Under Outgoing claim type, select Group Under Outgoing claim value, enter 1 Copyright 2013 LogMeIn, Inc. 7

9 6.1 Set Authorization Limits Remove the default Issuance Authorization Rule and add a custom rule. 1. In AD FS 2.0 Management, click Action > Edit Claim Rules. 2. On the Edit Claim Rules window, click the Issuance Authorization Rules tab. 3. From the list, select the rule Permit Access to All Users and click Remove Rule. 4. On the Edit Claim Rules window, click Add Rule to open the Add Issuance Authorization Claim Rule Wizard. 5. Input all data in the wizard as shown in the table below. Add Issuance Authorization Claim Rule Tab Choose Rule Type Input or Action Under Claim rule template select Permit or Deny Users Based on an Incoming Claim Under Claim rule name, enter a name, for example Permit Group for LogMeIn Under Incoming claim type, select Group Under Incoming claim value, enter 1 Copyright 2013 LogMeIn, Inc. 8

10 7 Configure NTLM Pass-through for One-click Login Internet Explorer and Chrome should automatically recognize an intranet URL and use NTLM for FS server authentication. If the address is not recognized as intranet, add the FQDN of your ADFS to the Local intranet zone. This can be deployed to multiple computers via Group Policy. In Firefox, the domain should be added at this location: about:config > network.automatic-ntlm-auth.trusted-uris. Copyright 2013 LogMeIn, Inc. 9