duo admin console integration active directory

Set-AdfsResponseHeaders -SetHeaderName 'Content-Security-Policy' -SetHeaderValue $CSP $CSP = $CSP + ' frame-src ' + $apihostname $CSP = ((Get-AdfsResponseHeaders | Select -ExpandProperty ResponseHeaders).'Content-Security-Policy') Option #2 – If you have set existing CSP in AD FS 2019, run this PowerShell script to append the necessary changes: Set-AdfsResponseHeaders -SetHeaderName 'Content-Security-Policy' -SetHeaderValue 'default-src 'self' 'unsafe-inline' 'unsafe-eval' img-src 'self' frame-src '

Option #1 – If Content Security Policy (CSP) has not yet been set on AD FS 2019, run the following command to set CSP allowing the Duo Prompt: This environment also does not have any Relying Party Trusts (applications using AD FS for claims based authentication) configured:Ĭonfiguring Content Security Policy (CSP) on AD FS 2019Īs of Windows Server 2019, the Content Security Policy security feature was introduced to secure ADFS and therefore the inline DUO prompt will not load properly without adding the Duo API hostname with the format into the Content Security Policy security configuration: Note how the default Permit everyone and require MFA policy is not currently in use by any applications in this environment. The ADFS farm is now ready to leverage the Duo Authentication for two-factor authentication.ĭepending on the requirements in your environment, the default Access Control Policies may be sufficient but if it isn’t, you can configure additional ones by navigating to ADFS > Access Control Policies: In the Edit Authentication Methods window, select Duo Authentication for AD FS 1.2.0.17 and click OK: Navigate to AD FS > Service > Authentication Methods and click on the Edit link for Additional Authentication Methods: Repeat the steps above for the additional ADFS servers in the farm. The following prompt will be displayed upon completing the install: Place the unique key into notepad so you can use it for the deployment of the next ADFS server and then paste it into the Enter shared session key field: However, if you have more than one ADFS server or plan to deploy an additional one in the near future then select Enter shared session key option and generate a unique key with the following PowerShell cmdlets: If you only have one ADFS server in your farm then select either of the option would not matter.

Then decide whether you want to enable or disable the following 2 configuration parameters:

Log onto your internal ADFS server hosting the primary WIN database and run the duo-adfs3-1.2.0.17.msi MSI installer:Įnter the previously documented strings for: Install DUO MFA Adapter onto ADFS Servers Type ADFS into the search field to locate Microsoft ADFS in the applications list then click on the Protect button to the right:Ĭopy the 3 text strings down into notepad as you will need them for the deployment later: Navigate to Applications and click on Protect an Application View the checksums for the Duo downloads here: īegin by logging onto the Duo Admin Panel ( ) with an administrator account: This post serves to demonstrate the deployment of Duo to provide two-factor authentication for ADFS services using browser-based federated logins.ĭeployment instructions as demonstrated in this post can be found directly from Duo here: ĭownload the DUO AD FS installer package for Windows 2012 R2 and later here: Ĭopy the file to your internal ADFS in your farm. As a continuation of the AD FS deployment from two of my previous posts:ĭeploying a redundant Active Directory Federation Services (ADFS) Web Application Proxy servers on Windows Server 2019ĭeploying a redundant Active Directory Federation Services (ADFS) farm on Windows Server 2019

Duo admin console integration active directory