Complete this task to enable Integrated Windows Authentication (IWA) on Active Directory Federation Services (ADFS) 3.0 or 4.0.

Procedure

1. On the ADFS server, run PowerShell as administrator.

2. Use the following PowerShell commands to view the current ADFS settings:

$FormatEnumerationLimit=-1Get-ADFSProperties

Set-ADFSProperties –ExtendedProtectionTokenCheck None

a. Determine which user agents are used currently.

Get-AdfsProperties | select -ExpandProperty WiaSupportedUserAgents

Note the output from the command.


b. Specify the user agents that can participate in IWA:

Set-ADFSProperties -WIASupportedUserAgents @("<user_agent>", "<user_agent>","<user_agent>")

where"<user_agent>" is each user agent noted in the output from the previous step.

Note: If you are configuring IWA for Notes federated login, you must also specify the browser embedded in the Notes client. For Notes V10 and earlier clients, specify Mozilla/4.0. For Notes V11 and later clients, specify Mozilla/5.0.

For example:

Set-ADFSProperties -WIASupportedUserAgents @("MSIE 6.0", "MSIE 7.0", "MSIE 8.0", "MSIE 9.0", "MSIE 10.0", "Trident/7.0", "MSIPC", "Windows Rights Management Client","MS_WorkFoldersClient" ,"=~Windows\s*NT.*Edge", "Firefox/25.0", "Firefox/47.0", "Mozilla/4.0", "Mozilla/5.0")


c. Verify that the user agents specified in the previous step are configured:

Get-AdfsProperties | select -ExpandProperty WiaSupportedUserAgents

$FormatEnumerationLimit=-1Get-ADFSProperties

• For ADFS 4.0:
  
  a. Open ADFS Management.

  b. Click Service -> Authentication Methods.

  c. Click Edit Primary Authentication Methods.

  d. In the Primary authentication tab, intranet section, select Windows Authentication. Optionally select Forms Authentication. Forms Authentication allows users who cannot use IWA, such as Linux and Mac users, to authenticate with SAML.

• For ADFS 3.0:
  
  a. Open ADFS Management.

  b. Click Authentication Policies.

  c. Click Edit Global Primary Authentication.

  d. In Primary Authentication, Global Settings, Authentication Methods, clickEdit.

  e. In the intranet section, select Windows Authentication. Optionally selectForms Authentication. Forms Authentication allows users who cannot use IWA, such as Linux and Mac users, to authenticate with SAML.

Parent topic: Enabling IWA (ADFS only)

Related tasks
Creating ADFS service principal names (SPNs)
Enabling Integrated Windows Authentication on ADFS 2.0
Configure browsers for Integrated Windows Authentication

Help on Help

All Help Contents

Help on Help