Preparing Active Directory Federation Services (ADFS)

If your IdP is Microsoft Active Directory Federation Services (ADFS), complete these steps to prepare to use ADFS with Domino. make sure you meet the following requirements before you configure SAML in Domino®.

About this task

These steps are based on ADFS 4.0 and may vary if you use an earlier version.

Procedure

Verify that you meet the following requirements:
- One of the following versions of ADFS installed and configured:
  - 2.0 (Provided with Windows Server 2008 R2)
  - 3.0 (Provided with Windows Server 2012 R2)
  - 4.0 (Provided with Windows Server 2016)
- A Secure Sockets Layer (SSL) certificate on the ADFS server that is signed by a Certificate Authority (CA). The CA root cert should be deployed by a domain policy to clients, an ADFS best practice.
- The following components must be in the same Active Directory domain, unless Active Directory trust relationships are in place:
  - ADFS server
  - User records
  - Client computers from which users log in. (Integrated Windows Authentication only)
Verify that your ADFS server is operational. For steps, see the Microsoft article Verify That a Federation Server Is Operational.
Go to https://<ADFS server hostname>/adfs/ls/IdpInitiatedSignon.aspx and test that a user can log in.
- If you see the error This page cannot be displayed, enable the IdP sign on page:
  1. In a Windows PowerShell on the ADFS server, run the following command:
```
Get-AdfsProperties
```
  2. See if the line EnableIdpInitiatedSignonPage in the output is False:
```
EnableIdpInitiatedSignonPage    :False
```
  3. If the value is False, run the following command to set it to True:
```
set-ADfsProperties -EnableIdPInitiatedSignonPage $true
```
  4. Run the following command to confirm the change:
```
Get-AdfsProperties
```
  5. Restart the ADFS service.
- If you are unable to log in with Internet Explorer, verify that the browser is enabled for Integrated Windows Authentication:
  1. In Internet Options > Advanced, verify that the security setting Enable Integrated Windows Authentication is checked.
  2. In Internet Options > Security, click Sites and then Advanced. Add the ADFS server URL (https://<ADFS server>) to the list of websites.
Verify that the content of the following two fields match for each user:
- The Internet address field in the Domino directory Person document.
- The E-mail field in the user ADFS properties box.
Note: User login names are not the same as their email addresses, though they can look like email addresses.