- Turn the tables on your organization with Adaxes 2018.1’s Web Interface and reporting capabilities - Thu, Sep 20 2018
- Review: Softerra Adaxes – Automating Active Directory management - Thu, Jun 4 2015
- Azure Multi-Factor Authentication – Part 8: Delegating Administration - Tue, Apr 28 2015
Preconfiguring IIS
Before we can install the Portals and Web Service SDK, we need to make a change in Internet Information Services (IIS) to allow the application pools to be created properly.
Configuring the default application pool for .NET Framework 2.0
- Log on to the server running the Multi-Factor Authentication Server with administrative privileges.
- Run the Internet Information Services (IIS) Manager (inetmgr.exe).
- In the left navigation pane, expand the name of the server.
- On the pop-up screen “Do you want to get started with Microsoft Web Platform to stay connected with latest Web Platform Components,” click No.
- In the left navigation pane, select the Application Pools node.
- In the main pane, select the DefaultAppPool.
- In the task pane on the right, click Basic Settings….
- On the Edit Application Pool window, select .NET CLR Version v2.0.50727 as the .NET CLR version and Classic as the managed pipeline mode.
- Keep the option Start application pool immediately selected and click OK.
Importing the SSL/TLS certificate
To configure the Multi-Factor Authentication portals with SSL/TLS certificates, we’ll need to import the certificate from the public Certification Authority (CA) to the certificate store of the local machine and then put it to use in IIS. For the first task, perform these steps:
- Download or copy the certificate to the server.
- Right-click the certificate and select Install certificate from the context menu.
- Select Local Machine and click Next.
- On the Certificate Store screen, select Place all certificates in the following store.
- Click Browse….
- Select the Personal store for the local machine.
- Click OK.
- Click Next.
9. On the Completing the Certificate Import Wizard screen, click Finish.
Configuring the HTTPS binding for the default website
Now, configure IIS to use the certificate:
- Run the Internet Information Services (IIS) Manager (inetmgr.exe).
- In the left navigation pane, expand the name of the server.
- On the pop-up screen “Do you want to get started with Microsoft Web Platform to stay connected with latest Web Platform Components,” click No.
- Expand the Sites node.
- In the left navigation pane, select the Default Web Site node.
- In the right pane, click Bindings….
- Click Add….
- For Type, choose https.
- For SSL Certificate, pick the certificate from the drop-down list for the fully qualified domain name (FQDN) of the server on the Internet (for instance, mfa.domain.tld).
- Click OK.
- Click Close.
- Close the Internet Information Services (IIS) Manager.
Installing the User Portal
With the Multi-Factor Authentication Web Service SDK in place, we can install and configure both the User Portal and the Mobile Portal. Let’s start with the first:
Note:
Make sure you are logged on as a domain admin for this and consecutive steps in this article.
- Open the Multi-Factor Authentication Server Management console by searching for it on the Start Screen.
- In the left pane, click User Portal.
- On the Settings tab, fill in the external URL for User Portal URL. For example: https://mfa.domain.tld/MultiFactorAuth.
- Select your preferences. Common options to select are Allow users to select method, followed by a couple of authentication methods, such as Phone Call, Text message, and Mobile app.
- When you select Mobile app, also select the Allow users to activate mobile app check box and set a maximum number of devices using the Device limit setting. Settings are automatically saved.
- Click the Install User Portal button at the top of the Settings tab to open the Install User Portal wizard.
- On the Installation Guide screen, click Next >.
- On the Active Directory screen, click Next >.
- On the Launch Installer screen, click Next >.
The Install User Portal closes and the Multi-Factor Authentication User Portal window appears.
- On the Select Installation Address screen, click Next >.
- On the Installation Complete page, click Close.
Installing the Web Service SDK
Since both the User Portal and the Mobile Portal use the Web Service SDK to connect (remotely) to the MultiFactorAuth service (MultiFactorAuthSvc), we’ll start with installing it:
- In the left pane of the Multi-Factor Authentication management console, click Web Service SDK.
- Click the Install Web Service SDK… button.
- On the Select Installation Address screen, click Next > to accept the default application pool /MultiFactorAuthWebServiceSDK.
- On the Installation Complete screen, click Close.
Testing the Web Service SDK
Open Internet Explorer and visit https://localhost/multifactorauthwebservicesdk/. Ignore the certificate error (“The certificate does not cover localhost…”). You should see a list of supported operations for the PfWsSdk Web Service. This confirms the MFA Web Service SDK is correctly installed and fully functional.
Installing the Mobile Portal
The Multi-Factor Authentication management console does not offer a button to install the Mobile Portal, so we’ll kick off its installer from the folder where we installed the Multi-Factor Authentication Server:
- Open File Explorer as an administrator by typing its name in the Start Screen, right-clicking it in the search results, and selecting Run as administrator from the context menu.
- Navigate to C:\Program Files\Multi-Factor Authentication Server\.
Right-click MultiFactorAuthenticationMobileAppWebServiceSetup64.msi and select Install from the context menu.
- On the Select Installation Address screen, click Next > to accept the default /MultiFactorAuthMobileAppWebService virtual directory.
- On the Installation Complete screen, click Close.
Making the MFA Server aware of its existence
The Multi-Factor Authentication Server installation has no knowledge of the existence of the Mobile App Portal at this point. Let’s fix that:
- Open the Multi-Factor Authentication Server Management console.
- In the left pane, click Mobile App.
- For the Mobile App Web Service URL, fill in the externally resolvable address, starting with https:// and ending with /MultiFactorAuthMobileAppWebService.
- For Account Name, fill in your organization’s name.
Configuring Active Directory
After we installed the User Portal, a group (PhoneFactor Admins) was created in the Users container of the Active Directory environment. It’s a good thing to work with service accounts. Although we would prefer to use (group) Managed Service Accounts (gMSAs), unfortunately we can’t use them in this scenario. Therefore, we will create a service account based on a normal user account:
Creating the service account
- Log on to a domain controller for the domain to which the server running the Multi-Factor Authentication Server is domain-joined, or use the Remote Server Administration Tools (RSAT) to make a remote connection to a domain controller.
- Start the Active Directory Administrative Center (dsac.exe).
- At the top of the left navigation pane, switch from List View to Tree View.
- In the left navigation pane, expand the domain name and navigate to the Users container.
Note:
When your organization’s IT management policy suggests you create service accounts in a different container or Organizational Unit (OU), create it there. - In the right task pane, under Users, click New. From the context menu, select User.
- Specify at least a Full name, a SamAccountName, and a strong password (twice). My choice here is SA AzureMFA.
Note:
Make sure the password only contains English uppercase characters (from A through Z), English lowercase characters (from a through z), and Base 10 digits (from 0 through 9). Do not include non-alphanumeric characters (for example: !, $, #, or %) to avoid more work later on.
Note:
When your organization’s IT management policy contains a naming convention, follow it. - Under “Password options,” select Other password options and then select Password never expires.
- Select Protect from accidental deletion.
- Click OK.
Making the service account a member of PhoneFactor Admins
Then, we’ll add the service account to the PhoneFactor Admins group:
- When you’ve created the service account in another container or OU, navigate back to the Users container.
- Locate and select the PhoneFactor Admins global security group.
- Right-click the object and select Properties from the context menu.
- In the left navigation pane of the PhoneFactor Admins Properties window, click Members.
- Click the Add… button next to the list of current members of the group.
- Type (the beginning of) the name of the service account (in my case, SA AzureMFA) and click the Check Names button.
Your service account should now appear underlined in the list. - Click OK.
- Click OK to close the PhoneFactor Admins Properties window.
- Close the Active Directory Administrative Center.
- Log off.
In an environment with multiple Active Directory domain controllers, allow sufficient time for replication to domain controllers near the Multi-Factor Authentication Server.
Configuring the Web Service SDK
Next, we’ll configure authentication for the Multi-Factor Authentication Web Service SDK:
- Run the Internet Information Services (IIS) Manager (inetmgr.exe).
- In the left navigation pane, expand the name of the server.
- On the pop-up screen “Do you want to get started with Microsoft Web Platform to stay connected with latest Web Platform Components,” click No.
- Select the Application Pools node in the left navigation pane.
- In the main pane, select the MultiFactorAuthWebServiceSDK application pool that the MFA Web Service SDK created. If it hasn’t been created, select the DefaultAppPool.
- In the task pane on the right, click Advanced Settings….
- From the list of settings, under Process Model, select Identity.
- Click the button with the three dots to the right of ApplicationPoolIdentity.
- In the Application Pool Identity window, select Custom account.
- Click Set….
- On the Set Credentials pop-up, type the user name and the password (twice) for the service account that was created.
- On the Set Credentials pop-up, click OK.
- On the Application Pool Identity window, click OK.
- Next, in the left navigation pane of Internet Information Services (IIS) Manager, navigate to the MultiFactorAuthWebServiceSDK application pool under Default Website.
- In the main pane, double-click Authentication.
- Right-click Anonymous Authentication and select Disable from the context menu.
- Right-click Basic Authentication and select Enable from the context menu.
- Close the Internet Information Services (IIS) Manager.
Configuring the Mobile Portal
Because the Multi-Factor Authentication Mobile App Web Service offers validation options when accessed from the local server, we’ll configure this portal first:
- Open Notepad as an administrator.
- By default, Notepad opens with a new document. From the File menu, select Open….
- Browse to the folder in which you have installed the MFA Mobile Portal. By default, it is located in C:\Inetpub\wwwroot\MultiFactorAuthMobileAppWebService.
- In the right bottom corner, change the file type from Text documents (*.txt) to All Files.
- Select and open Web.Config.
- In the appSettings section, make two changes:
- In the line containing the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME, change value=""/> to include the domain name and username for the service account that runs the application pool of the Web Service SDK. I changed it to value="DOMAIN\SAAzureMFA"/>.
- In the line below that, add a password value, in the same way you added the username, for WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD.
- In the pfup.Properties.Settings section (almost at the end of Web.Config), make one change. Change <value>http://localhost:4898/PfWsSdk.asmx</value> to <value>https://EXTERNALFQDN/MultiFactorAuthWebServiceSDK/PfWsSdk.asmx</value>. (Change EXTERNALFQDN to the externally resolvable DNS domain name for the MFA Server for which the SSL/TLS certificate was issued.)
- From Notepad’s File menu, select Save.
- From NotePad’s File menu, select Exit.
- Now, open Internet Explorer and navigate to https://localhost/MultiFactorAuthMobileAppWebService.
Follow the TestPfWsSdkConnection and TestSecurity links to ensure the connection to the Multi-Factor Authentication Web Service SDK is successful and the Mobile App Web Portal is secure.
Configuring the User Portal
Next, we’ll configure the Multi-Factor Authentication User Portal to successfully authenticate to the Multi-Factor Authentication Web Service SDK:
Subscribe to 4sysops newsletter!
- Open Notepad as an administrator.
- By default, Notepad opens with a new document. From the File menu, select Open….
- Browse to the folder in which you have installed the MFA User Portal. By default, it is located in C:\Inetpub\wwwroot\MultiFactorAuth.
- In the right bottom corner, change the file type from Text documents (*.txt) to All Files.
- Scroll down the list of files and then select and open Web.Config.
- In the appSettings section, make three changes:
- Because the Multi-Factor Authentication User Portal can use both RPC (directly) and a connection to the Web Service SDK to communicate with the MultiFactorAuth service, we’ll change value="false"/> to value="true"/> for USE_WEB_SERVICE_SDK.
- In the line below the previous line, change value=""/> to include the domain name and username for the service account that runs the application pool of the Web Service SDK. I changed it to value="DOMAIN\SAAzureMFA"/>.
- In the line below that, add the password in the same way you added the username.
- In the ApplicationSettings section (almost at the end of Web.Config), make one change. Change <value>http://localhost:4898/PfWsSdk.asmx</value> to <value>https://EXTERNALFQDN/MultiFactorAuthWebServiceSDK/PfWsSdk.asmx</value>. (Change EXTERNALFQDN to the externally resolvable DNS domain name for the MFA Server and for which the SSL/TLS certificate was issued.)
- From Notepad’s File menu, select Save.
- From NotePad’s File menu, select Exit.
- Now, open Internet Explorer and navigate to https://localhost/MultiFactorAuth.
Concluding
We’ve successfully installed and configured the User Portal, Mobile Web App Service, and Web Service SDK in this article. In the next article, we’ll look configure the settings of our Multi-Factor Authentication Server.
Read the latest IT news and community updates!
Join our IT community and read articles without ads!
Do you want to write for 4sysops? We are looking for new authors.
Excellent article for a real step by step.
But, I think there is one error.
Instead of:
https://EXTERNALFQDN/MultiFactorAuthWebServiceSDK/PfWsSdk.asmx.
I think you need to put:
https://EXTERNALFQDN/MultiFactorAuthWebServiceSdk/PfWsSdk.asmx.
I copied this from your website and it wasn’t working before I changed it to Sdk.
Hi Sander,I have a strange question for you. Would it be possible to manage user enrollment from the MFA cloud portal and have directory sync to the MFA Server? Ideally I would like to perform most management tasks from the portal, however I require MFA Server as I would like to utilise MFA capabilities for VPN access. Would I be correct in thinking its either one or the other and not both; MFA Server & MFA Cloud portal, for admin tasks?Thanks in advance.
Terry
Hi Sander,
I discovery MFA on-premise server. I wonder this case answer and how can i solve this problem using mfa.
I am doing vpn to our branch, and there is a firewall. That firewall have only one active rule, that rule direct to mfa server. But I dont see any two factor(text message or any call), I can directly access branch. That users enabled on MFA server.
How can ı solve this on MFA ?
Can MFA do some users not access using vpn to branch or company network area, is it possible? We can block on firewall but We need to know , Can MFA do that?
Hi Sander,
Thanks for this article, I have a query on this. I am setting up an azure MFA 8.0.1.1 and I want to know if setting for User Portal, and the Web Service SDK all require .NET CLR version 2 still.
I have default site and under that MFA web sdk and Multifactor auth is set up.
there is an article which suggest the same. https://dirteam.com/sander/2015/03/27/knowledgebase-azure-mfa-portal-shows-error-error-communicating-with-the-local-multi-factor-authentication-service-please-contact-your-administrator/