WatchGuard Access Portal SAML Authentication to Exchange with ADFS

Deployment Overview

You can configure single sign-on (SSO) to use SAML authentication and enable your users to log in through one portal and get access to multiple services.

This document describes how to set up SAML authentication through the WatchGuard Access Portal with Microsoft Active Directory Federation Services (ADFS) as the Identity Provider. In this integration, we show how to enable SSO connections to Exchange through the Microsoft Web Application Proxy (WAP) for ADFS claims-based authentication to the Outlook web application on an Exchange server.

For more information about integration of ADFS with WAP and Outlook, see the Microsoft documentation for these products.

Test Topology

This integration includes these components:

• Active Directory Federation Services (ADFS) Server — Provides claims-based authentication for single sign-on
• Web Application Proxy (WAP) — uses ADFS to perform pre-authentication for access to web applications, and also functions as an ADFS proxy
• Microsoft Exchange Server — uses ADFS claims-based authentication for client access to the Outlook web application
• Firebox — Hosts the Access Portal where clients authenticate for access to web applications

Configure the Firebox and Access Portal

The WatchGuard Access Portal is a subscription service. Before you can enable the Access Portal feature and configure it on your Firebox, you must make sure the Firebox feature key has an Access Portal license.

Enable the Access Portal and Add the Web Application

1. Log in to Fireware Web UI.
2. Select Subscription Services > Access Portal.
   The Access Portal page appears with the Applications tab selected by default.
3. Select the Enable Access Portal check box.

4. In the Applications tab, select Add > Web Application.
   The Add Web Application page appears.

5. In the Name text box, type the application name (Exchange).
6. In the Description text box, type a description for this application.
7. To upload a custom icon for this application, select Custom Icon (optional).
8. In the URL text box, type the URL for the mail server login page. This is the URL published by the WAP.
9. Click OK.

Configure the User Connection Settings

1. Select the User Connection Settings tab.
2. In the User Access settings, select All applications are available to all users and groups authenticated with the Access Portal.

Configure the SAML Service Provider Settings

1. Select the SAML tab.
2. Select the Enable SAML check box.

3. In the IdP Name text box type the name of your identity provider. This name appears on the Access Portal login page as the authentication server name.
4. In the Host name text box, type an FQDN that resolves to the Firebox external interface.
5. In the IdP Metadata URL, specify the connection settings. For ADFS, this URL should be like:
   https:// DnsHostName of ADFS server/federationmetadata/2007-06/federationmetadata.xml
6. Leave the default value for other settings.
7. Click Save.

Add a Static NAT Action

Add a static NAT action for connections to the WAP server.

1. Select Firewall > SNAT.
2. Click Add.
3. In the Name text box, type WAP.
4. In the Description text box, type a description (optional)
5. Set the Type to Static NAT.
6. In the SNAT Members list, click Add.
   The Add Member dialog box appears.

7. From the IP Address or Interface drop-down list, select Any-External.

In Fireware v12.2 or lower, the IP Address or Interface drop-down list is named External/Optional IP Address.

8. From the Choose Type drop-down list, select Internal IP Address
9. In the Host text box, specify the IP address of the WAP server on the private network.
10. Click OK.
    
    The SNAT member is added to the SNAT action.

11. Click Save.

Add a Policy for Connections to the WAP Server

Add an HTTPS proxy policy for connections through the Firebox to the WAP server. This policy uses the SNAT action you created earlier.

1. Select Firewall > Firewall Policies.
2. Click Add Policy.
3. In the Select a policy type settings, select Proxies.
4. From the Proxies drop-down list, select HTTPS-proxy, and select the HTTPS-Client.Standard proxy action.

5. Click Add Policy.
6. In the From list, add Any-External and Any-Optional.
7. In the To list, add Any-Trusted, and the WAP SNAT action that you added earlier.

8. Leave the default value for the other policy settings. Click Save.

Get SAML Configuration Metadata

1. Go to https://<host name>/auth/saml.

2. In the Option 1 section, click Copy.
3. Paste the URL into a browser and save the metadata on the web page to a XML file.

Import the ADFS Server Certificate to the Firebox

1. Get the ADFS server CA certificate and the certificate issue to ADFS server host.
2. Import those certificates to the Firebox. For more information see, see Manage Device Certificates in Fireware Help.

Configure ADFS

1. Log in to ADFS manager.
2. Navigate to Relying Party Trust.

3. Click Add Relying Party Trust.
   The Add Relying Party Trust Wizard starts.
4. On the Welcome to the Add Relying Party Trust Wizard page, select Claims aware.
5. Click Start.
   The Select Data Source step appears.

6. Select Import data about the relying party from a file. Click Browse to select the metadata file you saved earlier. Click Next.
   The Specify Display Name step appears.

7. Specify a Display name. Click Next.
   The Choose Access Control Policy step appears.

8. From the access control policy list, select Permit everyone. Click Next.
9. On the Ready to Add Trust page, click Next.
10. Click Close to finish the wizard.
    The new Relying Party Trust is added to the list.

11. Select the Access Portal trust you added, and click Edit Claim Issuance Policy.
    The Edit Claim Issuance Policy dialog box appears.

12. Click Add Rule.
    The Add Transform Claim Rule Wizard starts.
13. Create the rule Send LDAP attributes as Claims.
14. Configure the rule with these settings:
    • Attribute Store: Active Directory
    • LDAP Attribute: User-Principal-Name
    • Outgoing Claim type: UPN

15. Add a second rule Transform an incoming claim.
16. Configure the rule with these settings:
    • Incoming claim type: UPN
    • Outgoing claim type: Name ID
    • Outgoing name ID format: UPN

17. Click Apply and OK.
    The two Issuance Transform Rules are now configured.

Test the Integration

After you have completed these configuration steps, you can log in to the Access Portal to test the integration.

1. In a browser, go to https://<Firebox URL>.

2. Click the button that matches the identity provider name you specified in the Access Portal SAML configuration. In our example, we the button is labeled as IDP.
   The ADFS login page appears in the browser.
3. Type a Username and Password to authenticate with the AD server.
   The Access Portal appears.

4. Click the Exchange application and verify that the application successfully opens.