Template:Setup Active Directory Federation Services
MailStore Server can be configured to authenticate against Active Directory Federation Services (AD FS) when using the Active Directory or LDAP Generic directory service connectors. This guide assumes that you already have AD FS installed configured and only describes the parts specific to MailStore.
To allow MailStore to request OIDC tokens from AD FS, you have to create an Application Groups in AD FS. This Application Groups has to be configured in MailStore to establish a trust erlationship between those two systems.
- Login to your AD FS server system.
- Open the AD FS management console.
- Navigate to Application Groups.
- Right click on Application Groups and select Add Application Group.. or click Add Application Group.. in the Actions pane.
- Enter a Name, e.g. MailStore, and select the template Native application acessint a web API.
- Click Next.
- The Client Identifier of this application group is shown. Copy its value, since it is required later in MailStore.
- In the field Redirect URI, enter a URI in the format (without brackets)
- with the following components:
https://protocol is obligatory. To avoid certificate warnings during user logon, the web browsers on the client machines must trust the certificate used by MailStore Server.
The Fully Qualified Domain Name (FQDN) of your MailStore Server that consists of the machine name and the DNS domain, e.g.
mailstore.example.com. This name must be resolvable by all clients from which users shall be able to log on to MailStore Server.
The TCP port of the MailStore Web Access (
8462by default). This value must be equal to the port configured in the section Base Configuration > Network Settings > MailStore Web Access / Outlook Add-in (HTTPS) of the MailStore Server Service Configuration. The TCP port has to be specified only if it is different from the default port of the HTTPS protocol (
The endpoint where MailStore Server expects the authentication responses of Azure AD. This path has to be specified exactly as stated here at the end of the redirect URI.
Examples for valid redirect URIs Product Machine Name DNS Domain TCP Port Resulting Redirect URI MailStore Server mailstore example.com 8462
Redirect URI with Fully Qualified Domain Name and MailStore Web Access default port
MailStore Server mailstore example.com 443
The port can be ommited if the HTTPS default port 443 has been configured for MailStore Web Access or as source port of a port-forwarding on the firewall or router.
MailStore SPE archive example.com 443
The instanceid of the instance is part of the Redirect URI.
- Copy the Redirect URI into the clipboard.
- Click Add to add the Redirect URI to the list of allowed URIs.
- Paste the Redirect URI into the Identifier field of the Web API configuration.
- Click Add.
- Click Next to continue.
- Choose an Access Control Policy for this Application Group.
- Click Next to continue.