Microsoft Exchange for Authentication via SAML

Hideez Enterprise Server – Integration of Hideez Server with Microsoft Exchange for Authentication via SAML

This guide provides step-by-step instructions for configuring ADFS (Active Directory Federation Services) as a Service Provider (SP) to enable authentication for OWA (Outlook Web App) and EAC (Exchange Admin Center). It outlines the process of using Hideez Server as an IdP for authentication in Microsoft Exchange via SAML.

Integrating Active Directory Federation Services (AD FS) Authentication with Exchange Outlook on the Web (OWA) and Exchange Admin Center (EAC)

1. Initial Setup

1. Prepare your Active Directory Federation Services (AD FS) environment and ensure connectivity to the Microsoft Exchange servers.

2. Validate prerequisites for claims-based authentication.

2. Configure AD FS and OWA

Step 1: Export AD FS Signing Certificate and Import to Exchange Servers

The AD FS server uses a token-signing certificate for encrypted communication and authentication between the AD FS server, Active Directory domain controllers, and Exchange servers. This self-signed certificate is automatically copied over to the Web Application Proxy server during the installation but is required to be manually imported into the Trusted Root Certificate store on all of the Exchange servers in the organization.

1. To export the certificate, log onto the AD FS server, launch the AD FS Management Console, navigate to AD FS -> Service -> Certificate

1. Select the certificate listed under Token-signing, right click and select on View Certificate…:

1. The general properties of the certificate will be displayed:

1. Proceed and navigate to the Details tab and click on the Copy to File… button:

1. Go through the Certificate Export Wizard to export the certificate:

1. Select DER encoded X.509 (.CER) format and proceed with the export:

Step 2: Create a relying party trust and custom claim rules in AD FS for OWA (Outlook on the web)

With the AD FS prerequisites configured, proceed to create the relying party trust for OWA (Outlook on the web) on the AD FS server by launching the AD FS Management console:

Navigate to AD FS -> Relying Party Trusts and click on Add Relying Party Trusts…:

Select Claims aware and click on Start:

Change the default Import data about the relying party published online or on a local network to Enter data about the relying party manually:

Step 3: Create Claim Rules in AD FS

• Define a Relying Party Trust in AD FS for Outlook on the Web (OWA).

• Create custom claim rules, such as the Pass Through UPN Rule:

  • Claim Rule Name: Pass Through UPN

  • Incoming Claim Type: UPN

Step 3.1: Create Claim Rules in AD FS

• Add claim rules in AD FS for the OWA relying party trust based on the example configurations.

Step 4 (Optional): Publish OWA via AD FS Web Application Proxy

• Use the AD FS Web Application Proxy to securely expose OWA for external access.

Step 5 (Optional): Create Relying Party Trust for EAC

• Repeat the steps for setting up a Relying Party Trust for the Exchange Admin Center (EAC).

Step 6 (Optional): Publish EAC via AD FS Web Application Proxy

• Configure the Web Application Proxy for the Exchange Admin Center (EAC).

Step 7: Configure Exchange Organization to Use AD FS Authentication

• Use the following PowerShell command:

  Set-OrganizationConfig -AdfsIssuer https://adfs.lab.hideez.com/adfs/ls/ -AdfsAudienceUris "https://exch.lab.hideez.com/owa/","https://exch.lab.hideez.com/ecp/" -AdfsSignCertificateThumbprint "7D533C61B531D056A0058BB0E2DDE4904E86FB7F"

Step 8: Enable AD FS Authentication on Virtual Directories

• Configure AD FS authentication for the OWA and EAC virtual directories using commands like:

  Set-OwaVirtualDirectory -Identity "OWA (Default Web Site)" -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false

Step 9: Restart IIS on Exchange Server

• Restart Internet Information Services (IIS) on the Exchange server to apply the configuration changes.

3. Configure AD FS in Service Provider (SP) Mode

AD FS operates as an Identity Provider (IdP) by default but can be configured to function as a Service Provider (SP) when integrating with third-party IdPs like Hideez Server.

Configure AD FS in SP Mode:

Step 1: Add Third-Party IdP:

• Open the AD FS Management Console.

• Navigate to Claims Provider Trusts → Add Claims Provider Trust.

• Upload the metadata XML file from the third-party IdP (e.g., Hideez Server).

• Assign a name to the IdP (e.g., Hideez IdP).

Step 2: Create Claim Rules for the Claims Provider Trust:

• Add a Pass Through UPN Rule:

  • Claim Rule Name: Pass Through UPN

  • Incoming Claim Type: UPN

4. SAML Configuration for AD FS on Hideez Server

1. Download metadata from AD FS:

   • URL: https://adfs.lab.hideez.com/FederationMetadata/2007-06/FederationMetadata.xml

2. Identify the required fields:

   • Entity ID: http://adfs.lab.hideez.com/adfs/services/trust

   • Assertion Consumer Service URL: https://adfs.lab.hideez.com/adfs/ls/

3. Configure the Hideez Server:

   • Name: ADFS OWA

   • Issuer/Entity ID: AD FS Entity ID

   • ACS URL: AD FS Assertion Consumer Service

4. Map the attributes:

   • Map http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn to Email.

Example Workflow:

1. The user navigates to OWA: https://exch.lab.hideez.com/owa/.

2. OWA redirects the user to AD FS for authentication.

3. AD FS forwards the request to the third-party IdP (e.g., Hideez Server).

4. The IdP validates the request and returns the SAML response to AD FS.

5. AD FS processes the claims and forwards them to OWA, completing the authentication.

---

Additional Resources:

• Microsoft Documentation on AD FS and OWA

• Redirecting Exchange Authentication to AD FS

• Configuring CyberArk Identity SSO Provider for OWA.