Installing SafeNet Agent for ADFS

This section describes how to install the SafeNet Agent for ADFS for use with SafeNet Trusted Access (STA).

Pre-installation checklist

Complete the following tasks before installation:

• Ensure that the ADFS server is installed and operational.

• Make a note of your STA service zone FQDN. You need it during installation. To find it, on the STA Token Management console, select COMMS > Auth Nodes. For example, the EU service zone uses cloud.eu.safenetid.com.

• Add the ADFS server as an auth node in STA. STA only processes authentication requests that come from a registered auth node.

• Download an agent encryption key file from STA.

• Install Microsoft .NET Framework 4.8

  Note

  The installer will automatically download and install .NET Framework on the Primary Server if it is not already available.
  .NET Framework must be installed manually on Secondary Servers to enable MFA after the installation/upgrade to this version of SafeNet Agent for ADFS.

• Execute the following PowerShell command to enable the IdP-initiated sign-on page:

  Set-AdfsProperties -EnableIdpInitiatedSignonPage $true

  The ADFS IdP-initiated sign-on page (https://<FQDNOfTheFederationService>/adfs/ls/IdPInitiatedSignOn.aspx) is disabled by default. Executing the PowerShell command enables the page.

Add Relying Party Trust for ADFS

The Relying Party Trust must be added manually. The MFA page will not display if the Relying Party Trust is not configured.

After a user successfully logs in, using the AD, view the OTP page (with two sign-in options) as follows:

1. Open ADFS Management.

2. Select Relying Party Trusts, and then click Add Relying Party Trust in the Actions pane.

   

3. Select the Claims aware radio button and click Start.

   

4. Enter the URL of the metadata file.

   https://<fqdn>/federationmetadata/2007-06/federationmetadata.xml

   

5. In the Display name field, enter a display name, and click Next.

   

6. Select an Access Control Policy and click Next.

   In the following example, the Permit everyone and require MFA for specific group option is selected.

   

7. Click Next.

8. Clear the Configure claims issuance policy for this application checkbox, and click Close.

   

   Note

   Documentation to add Relying Party Trust references the Microsoft documentation. Please refer to the official documentation for detailed, accurate, and updated instructions.

Install SafeNet Agent for ADFS

To install the SafeNet Agent for ADFS:

1. Run the SafeNet Agent for ADFS installer as an administrator: SafeNet Agent for ADFS.exe

2. On the Welcome to the InstallShield Wizard for SafeNet Agent for ADFS screen, click Next.

   

3. On the License Agreement window, read the software license agreement and to proceed, select I accept the terms in the license agreement, and click Next.

   

4. On the Customer Information window, perform the following steps:

   1. In the User Name field, enter your user name.
   2. In the Organization field, enter the name of your organization.
   3. Click Next.

   

5. On the Destination Folder window, do one of the following:

   1. To accept the default installation destination folder, click Next.
   2. To change the installation folder, other than the default one, click Change, and then browse to locate and select the required folder.
   3. Click Next.

   

6. On the Authentication Service Setup window, enter the FQDN of your STA service zone as the primary server.

   

   Note

   With STA, you do not host the authentication service yourself, so there is no failover server to enter. Use the service zone FQDN that you noted in the pre-installation checklist, such as cloud.eu.safenetid.com for the EU service zone, and leave the failover field empty.

7. On the Ready to Install the Program window, click Install.

   

8. When the installation process completes, the Installshield Wizard Completed window displays. Click Finish to exit the installation wizard.

   

Upgrading and migrating settings for ADFS

SafeNet Agent for ADFS supports upgrades from version 2.01 and later.

Upgrades from version 2.0 and earlier (for example, v1.0, v1.01, and v2.0) are not supported.

Upgrade the agent

Before starting the upgrade process, it is strongly recommended to back up the existing SAFENET-MFA.ini file. This file is located in the agent installation directory (for example: C:\Program Files\SafeNet\SAS\SafeNetMFA\ini).

Follow the steps below to upgrade the agent:

1. Run the latest SafeNet Agent for ADFS installer on the same system where the existing agent version is installed.

2. After the upgrade is complete, open SafeNet Agent for ADFS in Run as Administrator mode.

   • Under the Policy tab, clear the Enable Agent check box if it is selected, and then close the console.

3. Open the backed-up version of the SAFENET-MFA.ini file in a text editor.

   • Copy your customized configuration entries and paste them one by one into the latest version of the SAFENET-MFA.ini file.

   • Repeat this process until you have transferred all required custom entries.

4. If you are using a language other than English (1033) or French-Canada (3084), you must translate any newly introduced localization strings and add them to the SAFENET-MFA.ini file.

   For more information about configuring localization, see localization.

5. After you complete the transfer of all customized entries, save the SAFENET-MFA.ini file.

6. Open SafeNet Agent for ADFS in Run as Administrator mode.

7. Verify that all customized configurations are correctly reflected in the SafeNet Agent for ADFS dialog box.

8. On the SafeNet Agent for ADFS console, under the Policy tab, select the Enable Agent check box.

9. Confirm that IdpEnvironment is still set to 1 in the SAFENET-MFA.ini file. An upgrade can restore the installed default of 0, which does not work with STA. See Set the agent variant for STA.

Removing users and groups

After you uninstall or deactivate the SafeNet Agent for ADFS, you must remove the users and groups from the ADFS server. Failure to do so can result in subsequent failure to authenticate through the ADFS server.

However, if you are preparing to install a later version of the SafeNet Agent for ADFS, you do not need to remove users and groups from the ADFS server.

Edit an MFA policy for users and groups

To edit an MFA policy for users and groups on the ADFS server:

1. In the ADFS management console, click Relying Party Trust.

2. Select the required Relying Party Trust application and Edit Access Control Policy.

3. Select any policy (from the Access control policy list) that does not require MFA, and apply the changes.