Question

Remove Forced Authentication for ADFS with Integrated Windows Authentication

Directory Server

Updated March 30

asked on March 26

We are using an Active Directory Identity Provider with ADFS authentication. We have Integrated Windows Authentication set up on the ADFS side. Laserfiche Web Client and Forms however are forcing authentication to our ADFS login page for our on campus users.

I believe this is because the AuthenticationContext is set to "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" and it needs updated to "unspecified". Is there anywhere to set that when using an AD Identity Provider instead of SAML?

I know Laserfiche has Integrated Windows Authentication available itself, but we still would prefer everything to go through ADFS. Our ADFS is already configured to handle logins both on campus and off campus, and we use it for audit logging.

0 0

Replies

replied on March 30

In ADFS, you can configure the forceAuthN option for each Relying Party.

select the Relying Party

Click "Edit Access Control Policy"

Find out which policy is chosen

Then inspect the policy in "Access Control Policies"

Double click the policy

Make sure this option is not checked.

0 0

replied on March 30

Hi Ting,

Thank you for the reply. We double checked ADFS side and that box is unchecked. We checked more with powershell as well and couldn't find anything on the ADFS side that would be forcing auth:

ResultantPolicy : RequireFreshAuthentication:False
IssuanceAuthorizationRules:
{
Permit users
and when authentication includes MFA
}

AlwaysRequireAuthentication : False

9e9122b2-b2c8-4a58-84aa-36d37c2f3771.PNG (12.65 KB)

| Download

0 0

You are not allowed to follow up in this post.

Question

Question

Remove Forced Authentication for ADFS with Integrated Windows Authentication

Replies

Sign in to reply to this post.