Template:Setup Active Directory Federation Services - Revision history

Ltalaschus at 07:17, 22 April 2021

2021-04-22T07:17:22Z

Ltalaschus at 06:56, 22 April 2021

2021-04-22T06:56:02Z

Ltalaschus at 06:43, 22 April 2021

2021-04-22T06:43:17Z

Ltalaschus at 06:17, 22 April 2021

2021-04-22T06:17:06Z

Ltalaschus: Created page with "MailStore Server can be configured to authenticate against Active Directory Federation Services (AD FS) when using the Active Directory or G..."

2021-04-21T15:35:22Z

Created page with "MailStore Server can be configured to authenticate against Active Directory Federation Services (AD FS) when using the Active Directory or G..."

New page

MailStore Server can be configured to authenticate against Active Directory Federation Services (AD FS) when using the [[Active Directory Integration|Active Directory]] or [[Generic LDAP Integration|LDAP Generic]] directory service connectors. This guide assumes that you already have AD FS installed configured and only describes the parts specific to MailStore.

To allow MailStore to request OIDC tokens from AD FS, you have to create an ''Application Groups'' in AD FS. This ''Application Groups'' has to be configured in MailStore to establish a trust erlationship between those two systems.

* Login to your AD FS server system.
* Open the AD FS management console.
* Navigate to ''Application Groups''.
* Right click on ''Application Groups'' and select ''Add Application Group..'' or click ''Add Application Group..'' in the '''Actions''' pane.
* Enter a ''Name'', e.g. ''MailStore'', and select the template ''Native application acessint a web API''.
[[File:Adfs_setup_01.png|center|550px]]
* Click ''Next''.
* The ''Client Identifier'' of this application group is shown. Copy its value, since it is required later in MailStore.
* In the field ''Redirect URI'', enter a URI in the format (without brackets)
*: <code>https://<fqdn>[:<port>]/oidc/signin</code>
*; with the following components<nowiki>:</nowiki>
*: '''https://''' Specifying the <code>https://</code> protocol is obligatory. To avoid certificate warnings during user logon, the web browsers on the client machines must trust the [[MailStore_Server_Service_Configuration#Certificate|certificate used by MailStore Server]].
*: '''FQDN''' The Fully Qualified Domain Name (FQDN) of your MailStore Server that consists of the machine name and the DNS domain, e.g. <code>mailstore.example.com</code>. This name must be resolvable by all clients from which users shall be able to log on to MailStore Server.
*: '''Port''' The TCP port of the MailStore Web Access (<code>8462</code> by default). This value must be equal to the port configured in the section ''Base Configuration > Network Settings > MailStore Web Access / Outlook Add-in (HTTPS)'' of the [[MailStore_Server_Service_Configuration#Services|MailStore Server Service Configuration]]. The TCP port has to be specified only if it is different from the default port of the HTTPS protocol (<code>443</code>).
*: '''/oidc/signin''' The endpoint where MailStore Server expects the authentication responses of Azure AD. This path has to be specified exactly as stated here at the end of the redirect URI.
::{| class="wikitable"
|+ Examples for valid redirect URIs
|-
! style="width:80px;" | Product
! style="width:80px;" | Machine Name
! style="width:90px;" | DNS Domain
! style="width:40px;" | TCP Port
! Resulting Redirect URI
|-
| align="center"| MailStore Server
| align="center"| mailstore
| align="center"| example.com
| align="center"| 8462
| <code><nowiki>https://mailstore.example.com:8462/oidc/signin</nowiki></code> Redirect URI with Fully Qualified Domain Name and MailStore Web Access default port
|-
| align="center"| MailStore Server
| align="center"| mailstore
| align="center"| example.com
| align="center"| 443
| <code><nowiki>https://mailstore.example.com/oidc/signin</nowiki></code> The port can be ommited if the HTTPS default port 443 has been configured for MailStore Web Access or as source port of a port-forwarding on the firewall or router.
|-
| align="center"| MailStore SPE
| align="center"| archive
| align="center"| example.com
| align="center"| 443
| <code><nowiki>https://archive.example.com/<instanceid>/oidc/signin</nowiki></code> The ''instanceid'' of the instance is part of the Redirect URI.
|-
|}
[[File:Adfs_setup_02.png|center|550px]]
* Copy the ''Redirect URI'' into the clipboard.
* Click ''Add'' to add the ''Redirect URI'' to the list of allowed URIs.
[[File:Adfs_setup_03.png|center|550px]]
* Paste the ''Redirect URI'' into the ''Identifier'' field of the ''Web API'' configuration.
* Click ''Add''.
* Click ''Next'' to continue.
[[File:Adfs_setup_04.png|center|550px]]
* Choose an ''Access Control Policy'' for this ''Application Group''.
* Click ''Next'' to continue.
[[File:Adfs_setup_05.png|center|550px]]

[[File:Adfs_setup_06.png|center|550px]]

[[File:Adfs_setup_08.png|center|550px]]

[[File:Adfs_setup_09.png|center|550px]]

[[File:Adfs_setup_10.png|center|550px]]

[[File:Adfs_setup_11.png|center|550px]]

[[File:Adfs_setup_12.png|center|550px]]

← Older revision		Revision as of 06:56, 22 April 2021
Line 89:		Line 89:
	[[File:Adfs_setup_12.png\|center\|550px]]		[[File:Adfs_setup_12.png\|center\|550px]]
	* Have the ''Client Identifier'' and the ''Redirect URI'' available and return to MailStore to proceed with the configuration of the [[Active Directory Integration\|Active Directory]] or [[Generic LDAP Integration\|LDAP Generic]] directory service connectors.		* Have the ''Client Identifier'' and the ''Redirect URI'' available and return to MailStore to proceed with the configuration of the [[Active Directory Integration\|Active Directory]] or [[Generic LDAP Integration\|LDAP Generic]] directory service connectors.
		+	<noinclude>
		+	[[de:Vorlage:Einrichtung_von_Active_Directory_Federation_Services]]
		+	[[en:Template:Setup_Active_Directory_Federation_Services]]
		+	</noinclude>

@@ Line 7: / Line 7: @@
 * Navigate to ''Application Groups''.
 * Right click on ''Application Groups'' and select ''Add Application Group..'' or click ''Add Application Group..'' in the '''Actions''' pane.
-* Enter a ''Name'', e.g. ''MailStore'', and select the template ''Native application acessint a web API''.
+* Enter a ''Name'', e.g. ''MailStore'', and select the template ''Native application acessing a web API''.
 [[File:Adfs_setup_01.png|center|550px]]
 * Click ''Next''.

@@ Line 58: / Line 58: @@
 * Click ''Next'' to continue.
 [[File:Adfs_setup_05.png|center|550px]]
-[[File:Adfs_setup_06.png|center|550px]]
+=== Optional: sAMAccountName as user name ===
-[[File:Adfs_setup_08.png|center|550px]]
+If you have configured MailStore to use the user principal name (UPN) or the local part of the user principal name, then these configuration steps are not required.
 [[File:Adfs_setup_09.png|center|550px]]
+* Select the ''Web API'' application and click ''Edit...''.
 [[File:Adfs_setup_10.png|center|550px]]
+* Click ''Add Rule...''.
 [[File:Adfs_setup_11.png|center|550px]]
+* Enter a ''Claim rule name''.
 [[File:Adfs_setup_12.png|center|550px]]

@@ Line 1: / Line 1: @@
-MailStore Server can be configured to authenticate against Active Directory Federation Services (AD FS) when using the [[Active Directory Integration|Active Directory]] or [[Generic LDAP Integration|LDAP Generic]] directory service connectors. This guide assumes that you already have AD FS installed configured and only describes the parts specific to MailStore.
+MailStore can be configured to authenticate against Active Directory Federation Services (AD FS) when using the [[Active Directory Integration|Active Directory]] or [[Generic LDAP Integration|LDAP Generic]] directory service connectors. This guide assumes that you already have AD FS installed and configured and only describes the parts specific to MailStore.
-To allow MailStore to request OIDC tokens from AD FS, you have to create an ''Application Groups'' in AD FS. This ''Application Groups'' has to be configured in MailStore to establish a trust erlationship between those two systems.
+To allow MailStore to request OIDC tokens from AD FS, you have to create an ''Application Group'' in AD FS. This ''Application Groups'' has to be referenced in MailStore to establish a trust erlationship between those two systems.
 * Login to your AD FS server system.
@@ Line 49: / Line 49: @@
 * Copy the ''Redirect URI'' into the clipboard.
 * Click ''Add'' to add the ''Redirect URI'' to the list of allowed URIs.
 [[File:Adfs_setup_03.png|center|550px]]
 * Paste the ''Redirect URI'' into the ''Identifier'' field of the ''Web API'' configuration.