Overview

The LoginTC AD FS Connector protects access to your Microsoft Active Directory Federation Services (AD FS) by adding a second factor LoginTC challenge to existing username and password authentication. The LoginTC AD FS Connector provides a LoginTC multi-factor authentication (MFA) method to your AD FS deployment, used by your Freshdesk SSO.

Architecture

User Experience

After entering the username and password into the AD FS login page, the user is shown a selection of second factor options. The user clicks a button to receive a LoginTC push notification, authenticates and is logged in.

Prerequisites

Before proceeding, please ensure you have the following:

• Freshdesk SSO configured with federation to your on-premise AD FS
• LoginTC Admin account
• Active Directory Federation Services (AD FS) Host, Microsoft Windows Server 2016 (or Windows Server 2012)

LoginTC Domain Creation

Create a LoginTC domain in LoginTC Admin. The domain represents a service (e.g. your corporate AD FS) that you want to protect with LoginTC. It will contain token policies and the users that access your service.

If you have already created a LoginTC domain for your AD FS deployment, then you may skip this section and proceed to Installation.

1. Log in to LoginTC Admin
2. Click Domains:
3. Click Create Domain:
4. Enter a name and optionally pick an icon
5. Scroll down and click Create

Installation

1. Download the latest version of the LoginTC AD FS Connector
2. Run the installer file as a privileged administrator user on the Windows Server with the AD FS role. Also ensure that the AD FS service is running prior to installing.
3. Press Next
4. Read the License Agreement and press Next if you accept the terms.
5. Change the LoginTC API Host only if you have a private enterprise LoginTC deployment. Press Next:
6. Enter your LoginTC Domain ID and Organization API Key. These values are found on your LoginTC Admin Panel. Press Next
7. Press Install. Note that the AD FS service will be restarted during installation and may be temporarily unavailable to your users.

AD FS Configuration

To configure your AD FS to use the LoginTC MFA method:

1. Open the AD FS Management console.
2. Click on the Services > Authentication Policies directory in the left side menu.
3. Click on Edit Global Multi-factor Authentication…
4. Check LoginTC in the list of MFA methods.
5. Click on Relying Party Trusts in the left side menu
6. Select the Relying Party you wish to add LoginTC MFA to
7. Click on Edit Access Control Policy… under Actions in the right sidebar
8. Select an access control policy that uses MFA (e.g. Permit everyone and require MFA)
9. Press Apply and OK

Your AD FS login will now present the user with a secondary LoginTC authentication page.

Usage

User Usage

The user proceeds to the Freshdesk portal as they normally would and press the Login button.

The user is brought to your on-premise AD FS where they are prompted to enter their username and password.

After successfully authenticating with their username and password, the user is presented with options to log in with LoginTC. The user may select to authenticate using LoginTC push, bypass codes, or OTPs.

If the user selects LoginTC push, they are informed to approve the LoginTC request on their device. The user is also presented with an option to remember their LoginTC login choice. The next time the user logs in they will automatically receive a LoginTC push notification. The user may also cancel the login attempt and return to the login page.

The user receives a push notification on their device where they have provisioned their LoginTC token.

After successfully authenticating with LoginTC, the user is redirected back to Freshdesk.

Logging

The LoginTC AD FS Connector logs events to the Microsoft Event Viewer under Applications and Service Logs → LoginTC. In some cases, it may be helpful to also look at the general AD FS logs under Custom Views → ServerRoles → Active Directory Federation Services.

Uninstallation

To uninstall the LoginTC AD FS Connector, simply navigate to the Add or remove programs in the Windows Control Panel, find LoginTC AD FS Connector in the list and follow the prompts.

Troubleshooting