If your IdP is Microsoft™ Active Directory Federation Services (ADFS), complete these steps to prepare to use ADFS with Domino. make sure you meet the following requirements before you configure SAML in Domino®.

About this task

These steps are based on ADFS 4.0 and may vary if you use an earlier version.

Procedure

1. Verify that you meet the following requirements:

• One of the following versions of ADFS installed and configured:
  • 2.0 (Provided with Windows Server 2008 R2)
  • 3.0 (Provided with Windows Server 2012 R2)
  • 4.0 (Provided with Windows Server 2016)
• A Secure Sockets Layer (SSL) certificate on the ADFS server that is signed by a Certificate Authority (CA). The CA root cert should be deployed by a domain policy to clients, an ADFS best practice.
• The following components must be in the same Active Directory domain, unless Active Directory trust relationships are in place:
  • ADFS server
  • User records
  • Client computers from which users log in. (Integrated Windows™ Authentication only)

3. Go to https://<ADFS server hostname>/adfs/ls/IdpInitiatedSignon.aspxand test that a user can log in.

• If you see the error This page cannot be displayed, enable the IdP sign on page:
  
  a. In a Windows PowerShell on the ADFS server, run the following command:
  
  Get-AdfsProperties
  
  b. See if the line EnableIdpInitiatedSignonPage in the output isFalse:
  
  EnableIdpInitiatedSignonPage    :False
  
  c. If the value is False, run the following command to set it toTrue:
  
  set-ADfsProperties -EnableIdPInitiatedSignonPage $true
  
  d. Run the following command to confirm the change:
  
  Get-AdfsProperties
  
  e. Restart the ADFS service.
• If you are unable to log in with Internet Explorer, verify that the browser is enabled for Integrated Windows Authentication:
  
  a. In Internet Options -> Advanced, verify that the security setting Enable Integrated Windows Authentication is checked.
  
  

  b. In Internet Options -> Security, click Sites and then Advanced. Add the ADFS server URL (https://<ADFS server>) to the list of websites.

• The Internet address field in the Domino directory Person document.
• The E-mail field in the user ADFS properties box.

Note: User login names are not the same as their email addresses, though they can look like email addresses.

Help on Help

All Help Contents

Help on Help