Setup Windows Integrated Authentication for Cloud Applications

Setup Windows Integrated Authentication for Cloud Applications

This guide gives a brief overview for Setting up Windows Integrated Authentication for Cloud Applications.

miniOrange Single sign on (SSO) server allows you to login to your applications without re-entering your credentials after you authenticate yourself into the Windows domain by login into a system joined to the Active Directory domain. miniOrange achieves this by, installing a component on a Windows Server joined to the Active Directory (AD) domain that, basically acts as a SAML 2.0 Identity Provider. When the user tries to access a cloud application like Salesforce, the request is sent to the miniOrange SSO Server which in turn forwards the request to the on-premise miniOrange SAML module installed in the Windows machine which determines the user logged in, and performs SSO based on the response from the module.

This involves 3 steps basically:

1. Enable Windows Authentication and configure SSO applications of interest in the Windows Machine.

2. Installing the miniOrange SAML module in Windows and configuring it with the miniOrange SSO server.

3. Add the miniOrange SAML module ( installed on the Windows Machine ) as an Identity Source in the miniOrange SSO server

Step 1: Setup IIS for Windows Authentication.

  1. Open up command prompt in Administrative mode.
  2. Execute the following command on it:$setspn -a HTTP/## Server FQDN## ##Domain Service Account#
  3. Open up Active Directory Users and Computers.
  4. Search for the service account which was used to create the Service Principal Name(SPN).
  5. Navigate to the Delegation tab.
  6. Select Trust this user for delegation to any service (Kerberos only).

windows authentication for cloud delegation

7. Click Apply.

8. Open up IIS Manager.

9. Select the site which you want to apply Windows Authentication to.

10. Select the Application Pool for that website. Right click on it and select Advanced Settings.

11. Use Custom Account and set the account as the service account for which delegation was enabled. You would need to enter the password of the service account as well.

windows authentication for cloud apppool

12. Navigate to the Authentication section for the website.

13. Enable Windows Authentication and disable Anonymous Authentication.

windows authentication for cloud kernel mode false

14. In the Configuration Editor, search for system.webServer/security/authentication/windowsAuthentication.

15. Set useKernelMode as False and useAppPoolCredentials as True.

windows authentication for cloud use app pool credentials

16. Click Apply.

17. Open up Internet Explorer and open Internet Options.

18. Add the FQDN of IIS Server to the list of sites in Local Intranet.

19. Select Custom Level for the Security Zone. In the list of options, select Automatic Logon only in Intranet Zone.

windows authentication for cloud browser settings

Step 2: Configure On-Premise SAML Module with miniOrange Identity Provider

A SAML 2.0 module needs to be installed on an IIS Server joined to the Active Directory Domain. This module will be responsible for identifying the user logged in to a domain-joined system and generating a SAML response to the connected application. When the user is trying to access a cloud application like Salesforce, the request is received by miniOrange which forwards the request to this SAML module installed on-premise, which generates a SAML response based on the user logged in and forwards it to miniOrange, which in turn forwards an authentication response to the application. The configuration of the SAML Module is as follows:
  1. Put in the URLs in the samlsso.php in the SAML Module.
    2. windows authentication for cloud SAML module urls
    Parameter Value
    ACS URL Of the format: https://login.xecurify.com/moas/rest/saml/acs/<CustomerID>
    Issuer The hostname of the server
    Audience https://login.xecurify.com/moas
  2. Save the file.

Step 3: Configure On-Premise SAML Module as an Identity Source in miniOrange

  1. Login to the admin dashboard.
  2. Navigate to Identity Providers in the left navigation bar. windows authentication for cloud identity providers
  3. Click on Add Identity Source.
    4. windows authentication for cloud Add identity source
  4. Add a SAML Identity Source in miniOrange with the details of the on-premise SAML Module.
    Parameter Value
    IdP Entity ID / Issuer As set in the above step
    SAML SSO Login URL Of the format https://< hostname_of_server >/saml/samlsso.php
    X.509 Certificate The SP Certificate in the SAML Module
    windows authentication for cloud identity source configuration
  5. Save the Identity Source and make it as the Default Identity Source by clicking on Make Default.
At this point, the connection between miniOrange IdP and on-premise SAML Module is completed. If a user tries to access a connected application, miniOrange will send a SAML request to the on-premise SAML module, which will generate an assertion based on the user logged in into a domain-joined system and send it to miniOrange. miniOrange will forward an authentication response to the connected application and the user will get signed in.