9.31 Web Authentication Method

Advanced Authentication facilitates you to authenticate with different Identity Providers, such as OAuth 2.0, OpenID Connect, and SAML 2.0 with the Web Authentication method. The Web Authentication method uses browser and http based authentication protocols and can be used in web environment or hybrid applications.

Before you configure the Web Authentication method, ensure that you set the correct Public external URLs (load balancers) that provisions Advanced Authentication to the users.

NOTE:Ensure that you use a valid certificate for the Advanced Authentication server. Users may face enrollment issues on the Internet Explorer and Microsoft Edge browsers, if the certificates are not valid.

To configure the Web Authentication method for Advanced Authentication, perform the following steps:

  1. Click Methods > Web Authentication.

  2. Click Add in Identity providers.

  3. Select the Authentication type.

  4. Click the arrow icon.

Web authentication method supports the following authentications:

You can configure the Web Authentication method to use the following Identity Providers:

9.31.1 SAML for Advanced Authentication

To add the SAML Identity Provider, perform the following steps:

  1. Specify the identity provider name in Identity Provider.

  2. Select the Available presets for Name ID Format.

    The Name ID Format is automatically populated.

    or

    Specify manually in Name ID Format.

  3. Click Browse to upload the Identity Provider Metadata file.

    WARNING:Ensure that you choose the Identity Provider Metadata file that is exported from a used Identity Provider. Do not use the metadata file exported from the Administrative Portal > Policies > Web Authentication.

    NOTE:The Web Authentication method supports only HTTP-POST for the Single Sig-On (SSO) Service Binding parameter in the metadata file. The HTTP-Redirect is not supported.

  4. Click the save icon.

  5. In the Upload SAML Service Provider signature certificate section, you must upload a certificate file in the PEM format with a private key. This certificate is used by the Web Authentication method to sign a SAML AuthnRequest token.

    If the private key is protected by a password, specify the password in Private key password.

  6. Click Save.

An Example Configuration with ADFS

Perform the following steps to add ADFS as an Identity Provider for the Web Authentication method.

  1. Specify myexample-adfs as the IdP provider name.

  2. Select urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName from Available presets for Name ID Format.

    The selected Name ID Format will be extracted from the SAML AuthnResponse token and saved as an authentication data (unique data which will be associated with the user).

  3. Click Browse to upload the IdP Metadata file from the ADFS server.

  4. Click the save icon.

  5. In the Upload SAML Service Provider signature certificate section, upload a certificate file in the PEM format with a private key.

    If the private key is protected by a password, specify the password in Private key password.

  6. Click Save.

Configuring the ADFS Identity Provider

  1. Save the Service Provider metadata from Advanced Authentication to a file. Use the URL mentioned below to obtain the Service Provider metadata:

    https://AAF_SERVER/webauth/TENANT/metadata

    NOTE:The default TENANT is TOP. Use TOP as TENANT if you are not using multi-tenancy.

    A sample Service Provider metadata is mentioned below:

    <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_7a8608ad1cfbc149" entityID="https://www.d18r14.tk/webauth">
<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
<md:KeyDescriptor>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:KeyName>https://www.d18r14.tk/webauth</ds:KeyName>
<ds:X509Data>
<ds:X509Certificate>
MIIEOzCCAyOgAwIBAgIJAJcsrIQZzcT0MA0GCSqGSIb3DQEBCwUAMIGyMQswCQYD
VQQGEwJDSDEcMBoGA1UECAwTR3JlYXRlciBadXJpY2ggQXJlYTEPMA0GA1UEBwwG
WnVyaWNoMRcwFQYDVQQKDA5NaWNybyBGb2N1cyBBRzERMA8GA1UECwwIQXV0aGFz
YXMxFzAVBgNVBAMMDm1pY3JvZm9jdXMuY29tMS8wLQYJKoZIhvcNAQkBFiBhbGV4
YW5kZXIuZ2FsaWxvdkBtaWNyb2ZvY3VzLmNvbTAgFw0xNjA1MjAwOTMyMzlaGA8y
MTE2MDQyNjA5MzIzOVowgbIxCzAJBgNVBAYTAkNIMRwwGgYDVQQIDBNHcmVhdGVy
IFp1cmljaCBBcmVhMQ8wDQYDVQQHDAZadXJpY2gxFzAVBgNVBAoMDk1pY3JvIEZv
Y3VzIEFHMREwDwYDVQQLDAhBdXRoYXNhczEXMBUGA1UEAwwObWljcm9mb2N1cy5j
b20xLzAtBgkqhkiG9w0BCQEWIGFsZXhhbmRlci5nYWxpbG92QG1pY3JvZm9jdXMu
Y29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5ZjKCY2x2ruYkW8e
/IgOa5y9xqSx4bUogYuZnAwLgZH2EIEx54T1YzKKc6a58t9tFU0Xb1Z47ay57g/B
A1oOOV4HOsl6SRG4lJojiOKSpLb1zZMqj3s1dd9hLE9KuScchApcJ5F8GxPf6YHO
VpY4d6e6Z+fS071lK3UHpjbLQ71yoDV+s+wJ+pmgsLxiyV/7A+CurxixibyXKx2x
jHvynZBPWf1P/goi54gbCZ1PjQnRPKfxUzRvWipH8T2xvfT0UAZL3HO8C6JJGZxQ
t82lw/za9tADH0CxPolL/JJyHeEGJAj07uw1wks6mEv8wZY5KkhuDpVv6BUl146+
tL5LSQIDAQABo1AwTjAdBgNVHQ4EFgQUoeHvvSDZn/GIul8Q6T0yleN9q48wHwYD
VR0jBBgwFoAUoeHvvSDZn/GIul8Q6T0yleN9q48wDAYDVR0TBAUwAwEB/zANBgkq
hkiG9w0BAQsFAAOCAQEAQ+T4XForCi/FFSpNLVxb7x/yO1eBi7JujH7CfNTKXUC3
STlTZiJaTLVXzNd9dvxSjzAoDy4NVV/T4KiA4ss7JCTPwGrD3S8k/a+GpogRzRcE
R1i/Z/bx2I4PmQk1g1z4lpuqnic0aIg/OVAE0+kwDBK3E0/pgpoSixAAvxEqM5tw
X9vdt3W/QCoAO3rFABRDboaLkslGbk80Q37tEASKFYm4/0fyB3PEv2uL0S6rP/+E
Fp1Xhlk/5MVRHNb0hLqpZmJxne96dnXpo+ZDeCCn87B3257eRFI1eUeAnxuw79vv
uterPobGSjjPm+y7sY2U3hLKsoVymRvqAohrd9kXSQ==
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</md:KeyDescriptor>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.d18r14.tk/webauth/callback" index="0"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>

  2. In the ADFS Management console, click Relying Party Trusts > Add relying party trust.

  3. In the Add Relying Party Trust wizard, click Start.

  4. Select Import data about the relying party from a file.

  5. Click Browse to upload the Advanced Authentication’s metadata file that you created in Step 1.

  6. Click Next.

  7. Specify the Display name.

  8. Click Next.

  9. Ensure that Open the Edit Claim Rules dialog for this relying party trust when the wizard closes is selected.

  10. Click Close.

    The Edit Claim Rules wizard is displayed.

  11. Click Add Rule.

  12. Select Transform an Incoming Claim from Claim rule template.

  13. Click Next.

  14. Specify the Claim rule name.

  15. Set Incoming claim type to Windows account name.

  16. Set Outgoing claim type to Name ID and Outgoing name ID format to Windows Qualified Domain Name.

  17. Ensure that Pass through all claim values is selected.

  18. Click Finish.

  19. Click OK.

  20. In the ADFS Management console, click Relying Party Trusts and select the relying party trust you added.

  21. Right-click on the relying party trust and select Properties from the menu.

  22. In Properties, click the Encryption tab and remove the certificate by clicking Remove.

  23. Click OK.

    NOTE:Web authentication method does not support the encrypted tokens.

9.31.2 OpenID Connect for Advanced Authentication

To add the Open ID Connect Identity Provider, perform the following steps:

  1. Specify the name of the provider in Provider name.

  2. Select the Available presets.

    The Issuer, Scope, and Key field are automatically populated.

  3. Specify the Client ID and Client secret.

    The Client ID and Client secret can be obtained by registering with the respective Identity Provider that you select, for more information see Integrating Third Party Applications with Advanced Authentication Using OpenID Connect.

    NOTE:Set the Callback URL at the respective Identity Provider. For example, https://<aahostname>/webauth/callback.

  4. Turn Send Client secret as an URL parameter to ON to send the Client secret as a URL. By default, the option is set to OFF.

  5. Click the save icon.

  6. Click Save to save the method configuration.

Integrating Third Party Applications with Advanced Authentication Using OpenID Connect

The following sample configurations explains how to configure third party applications with Advanced Authentication using OpenID Connect.

Integrating Advanced Authentication with Facebook

Perform the following steps to integrate Advanced Authentication with Facebook using OpenID Connect:

  1. Login to facebook for developers.

  2. Click My Apps.

  3. In the left pane, click Settings > Basic.

  4. Make a note of App ID and App Secret. These are the Client ID and Client Secret for Advanced Authentication.

  5. In Display Name, specify Advanced Authentication. This is the name for this OpenID Connect configuration.

  6. In App Domains, specify the domain name of the Advanced Authentication Server. For example aafapp.demo.live.

  7. In Privacy Policy URL, specify the URL of the Advanced Authentication Server. For example aafapp.demo.live.

  8. Scroll through the page until you find the Website section. If you cannot find the Website section, click Add Platform > Website.

  9. In the Website section, specify the web address of the Advanced Authentication Server. For example aafapp.demo.live.

  10. Click Save Changes.

  11. In the left pane, click Settings > Advanced.

  12. Scroll through the page until you find the Domain Manager tab.

  13. Click Add a Domain.

  14. In the Add a Domain window, specify the URL of the Advanced Authentication Server in Site URL. For example aafapp.demo.live.

  15. Click Apply.

  16. Click Save Changes.

  17. In the left pane, click App Review.

  18. Make your application public by clicking the toggle switch in the Make Advanced Authentication public? section.

  19. In the left pane, below the Products tab, click Settings.

  20. In Valid OAuth Redirect URIs, specify https://<Advanced Authentication Server>/webauth/callback.

  21. Click Save Changes.

  22. Specify the Client ID and Client Secret generated in Step 4 in the Client ID and Client Secret fields of Advanced Authentication Administrative Portal.

Integrating Advanced Authentication with Google

Perform the following steps to integrate Advanced Authentication with Google using OpenID connect:

  1. Login to Google APIs.

  2. Click Credentials > Create.

  3. Specify a Project Name and a Location.

  4. Click Create.

  5. Click Create credentials > OAuth client ID.

  6. Click Configure a consent screen.

  7. Specify a name in the Application name field. For example Advanced Authentication.

  8. In Authorised domains, specify the domain name of the Advanced Authentication Server. For example aafapp.demo.live.

  9. In Application Homepage link, specify the web address of the Advanced Authentication Server. For example https://aafapp.demo.live.

  10. In Application Privacy Policy link, specify the web address of the Advanced Authentication Server. For example https://aafapp.demo.live.

  11. In Application type, select Web application.

  12. In Application Terms of Service link, specify the web address of the Advanced Authentication Server. For example https://aafapp.demo.live.

  13. In Name, specify a name for the OpenID Connect configuration.

  14. In Authorized JavaScript origins, specify the Advanced Authentication server address. Ensure that you specify the complete server address including https. For example https://aafapp.demo.live.

  15. In Authorized redirect URIs, specify https://<Advanced Authentication Server>/webauth/callback. Ensure that you specify the valid Advanced Authentication server name inside <>.

  16. Click Save.

  17. Make a note of the client ID and client secret specified in the OAuth client window. Click OK.

  18. Specify the Client ID and Client Secret generated in Step 17 in the Client ID and Client Secret fields of Advanced Authentication Administrative Portal.

Integrating Advanced Authentication with Yahoo

Perform the following steps to integrate Advanced Authentication with Yahoo using OpenID connect:

  1. Login to Yahoo Developer Network.

  2. Click Create an app.

  3. In Application Name, specify a name for the OpenID Connect configuration.

  4. In Application Type, select Web Application.

  5. In Callback Domain, specify the domain name of the Advanced Authentication Server. For example aafapp.demo.live.

  6. Click Create.

  7. Make a note of the client ID and client secret. Click Update.

  8. Specify the Client ID and Client Secret generated in Step 7 in the Client ID and Client Secret fields of Advanced Authentication Administrative Portal.

Integrating Advanced Authentication with Microsoft Azure

Perform the following steps to integrate Advanced Authentication with Microsoft Azure using OpenID connect:

  1. Login to Microsoft Azure.

  2. In the left pane, click Azure Active Directory.

  3. In the Manage section, click App registrations.

  4. Click New application registration.

  5. In Name, specify a name for the OpenID Connect configuration.

  6. In Application Type, select Web app / API.

  7. In Sign-on URL, specify https://<Advanced Authentication Server>/webauth/callback. Ensure that you specify the correct Advanced Authentication server address inside <>.

  8. Click Create.

  9. Make a note of Application ID. It is the Client ID for Advanced Authentication.

  10. Click Settings > Keys.

  11. In the Passwords section, specify key description and key duration.

  12. Click Save.

  13. Make a note of the text generated in the VALUE field. It is the Client Secret for Advanced Authentication.

  14. In the left pane, click Azure Active Directory.

  15. Click Properties.

  16. Make a note of the text specified in the Directory ID field.

  17. Specify the text generated in Step 16 in the Issuer field of Advanced Authentication Administrative Portal.

  18. Specify the Client ID generated in Step 9 and Client Secret generated in Step 13 in the Client ID and Client Secret fields of Advanced Authentication Administrative Portal.

9.31.3 OAuth 2.0 for Advanced Authentication

To add the OAuth 2.0 Identity Provider, perform the following steps:

  1. Specify the name of the provider in Provider name.

  2. Select the Available presets.

    The Authorization endpoint, Token endpoint, Attributes endpoint, Scope, and Key field are automatically populated.

  3. Specify the Client ID and Client secret.

    The Client ID and Client secret can be obtained by registering with the respective Identity Provider that you select.

    NOTE:Set the Callback URL at the respective Identity Provider. For example, https://<aahostname>/webauth/callback.

  4. Turn Send Client secret as an URL parameter to ON to send the Client secret as a URL. By default, the option is set to OFF.

  5. Select the format of the access token from Access token is returned in body encoded as.

  6. Set Send access token in "Authorization: Bearer" header to ON to send the access token as a header. By default, the option is set to OFF.

  7. Click the save icon.

  8. Click Save to save the method configuration.