Changelog:

Update 7 Feb 2024: Laserfiche Directory Server 11 Update 5 (released 19 Oct 2023) introduced native support for SAML SLO. Documentation: Configuring Single Logout (SLO) with SAML Authentication

Updated 7 July 2021 with instructions on implementing Single Log Out (SLO) with AD FS

_____________________________

Hi Bert,

There are three parts to accomplishing what you're asking about.

Automatically selecting the Federated (AD FS) option on the STS login page:

Note that this works for any federated IdP (SAML) in addition to AD FS.

1. On the server where STS is installed, open file Explorer and navigate to ".\Program Files\Laserfiche\Directory Server\Web\WebSTS\Views\Home"
2. Make a backup copy of the "Login.cshtml" file and name it "Login-Original.cshtml" or similar
3. Open "Login.cshtml" in a text editor of your choice
4. Find the function called: "function checkAutoLogin()"
5. Replace it with this modified version, where "IdPNameExactlyAsItAppearsInLFDS" (in LFDS web admin -> Identity Providers) is hopefully self-explanatory. For AD FS, it is the associated AD IdP name you have AD FS enabled for.

   function checkAutoLogin()
   {
   	{
   		var logoutMarkup = getCookie("lfdsstsLogoutMarkup");
   		if (!logoutMarkup)
   		{
   			login(AuthType.Federation, "IdPNameExactlyAsItAppearsInLFDS")
   		}
   	}
   };

6. Open the "Embedded.cshtml" file in the same directory and replace the autoLoginFunction there as well.
7. Recycle the LicenseManagerSTS IIS Application Pool for the change to take effect.

[Optional but recommended]
Configure AD FS Single Log Out (SLO)

1. In AD FS, open the Relying Party Trust for Laserfiche and go to the "Endpoints" tab
2. Add a new SAML endpoint, with the following properties:
   1. Endpoint type: SAML
   2. Binding: Redirect
   3. Trusted URL: https://your-adfs-endpoint.example.com/adfs/ls/?wa=wsignout1.0
   4. Response URL: https://your-adfs-endpoint.example.com/logout 
   5. Example screenshot:
      
       
3. Updated post 7 Feb 2024 noting Laserfiche has native SAML SLO support as of LFDS 11 Update 5. Use that instead of this workaround.
   In the WebSTS Login.cshtml and Embedded.cshtml files described in the section above, replace the checkAutoLogin function with this version that includes both automatic IdP selection and the SLO redirect call. Make sure to update both the IdP name and samlLogoutURL (the "Trusted URL" from the previous step) placeholder values.

   function checkAutoLogin()
   {
   	{
   		var logoutMarkup = getCookie("lfdsstsLogoutMarkup");
   		if (!logoutMarkup)
   		{
   			login(AuthType.Federation, "IdPNameExactlyAsItAppearsInLFDS")
   		}
   		else
   		{
   			var samlLogoutUrl = "https://your-adfs-endpoint.example.com/adfs/ls/?wa=wsignout1.0";
   			window.location = samlLogoutUrl;
   		}
   	}
   };

4. Open the "SignOut.cshtml" in the same directory and find the "setLogoutMarkup" function. This sets the "lfdsstsLogoutMarkup" cookie we use to detect logout vs login. Within it there is a line reading:
   " var lifeTime = 1;"
   Update its value from "1" to "0.2" to change its lifespan from one minute to twelve seconds (0.2 min). With the auto-login plus SLO version of the code, you cannot attempt to log back in until this cookie expires. Twelve seconds should be long enough for even slow browsers/connections.

Configure AD FS to Always Require Authentication

Note: Implementing SLO as described above is at some level a client-side method of achieving a similar security goal. A dedicated attacker can trivially circumvent client-side SLO by blocking the redirect to the SLO endpoint in their browser. The method described below is enforced server-side and should be considered a required complimentary security measure for publicly-accessible sites, and an optional one for intranet-only sites.

Because logging out of LFDS only invalidates the Laserfiche STS token and not the AD FS token, it is important to configure the AD FS Relying Party Trust for Laserfiche to Always Require Authentication. This prevents someone using the same AD FS token to log back into Laserfiche without having to re-authenticate.

For step-by-step instructions, please see my post here:

Laserfiche Answers: Force Reauthentication with AD FS

Set the LFDS STS token duration

1. On the server where STS is installed, open a supported browser and go to https://localhost/LFDSSTS/configuration
2. Set the "Default session timeout (minutes):" field to the desired duration. The default is 1440 minutes (24 hours)
3. Click "Update" to save any changes

Other relevant settings

1. Repository: Idle Disconnect (timeout) settings (affects all clients)
2. Forms: Session idle timeouts (important note: Forms session timeouts trigger logout of all Laserfiche web applications and invalidate a user's current STS token)

I'm working on a way to have logging out in Laserfiche also kill the AD FS token (which is a bit more elegant than enabling Always Require Authentication in AD FS) and will update this post if and when I sort that out. Note: Updated post 7 July 2021 with this solution (SLO).

Let me know if that helps and please mark this as the Answer if it addresses your question.

Cheers,
Sam