Sales
Denmark +45 7944 7000
Europe +45 7944 7000
North America +1 (202)-536-4165
Support
Denmark +45 7944 7002
North America +1 (202)-536-4165

External Authentication Details for OAuth2 with ADFS

Modified on Thu, 26 Sep at 10:44 AM

Overview

This article provides step-by-step instructions on how to retrieve external authentication details for RC backend login using Microsoft account with OAuth2 via ADFS.

Requirements

Look at the following table for supported Windows Server versions and ADFS versions supported on these servers:

Supported Windows Server
Supported ADFS
Windows Server 2016
ADFS 4.0
Windows Server 2019
ADFS 5.0
Windows Server 2022
ADFS10.0


NOTE: For the Outlook Add-in to run with Single Sign On it is from Resource Central Hotfix 8 needed to use the latest manifest version 1.10.0.

Authentication Details for OAuth2 with ADFS

Part A. Configure Active Directory Federation Services (ADFS)

1. Go to web server where your Exchange server is installed, click Start  Server Manager  Tools  AD FS Management2. In the opened window, select Application Groups and [Add a new Application Group] from the Actions sidebar. This starts the configuration wizard for a new Group.

3. On the ‘Add Application Group wizard’ ➔ Welcome screen, fill in Name and select “Server application accessinga web API” in Template and Click “Next

4. On the next screen (Server application), fill in Redirect URI and Click “Add” then Click “Next”. You will have to provide 2 URLs: one for receiving login details from ADFS, one for receiving logout information from ADFS

The URL for receiving login details from ADFS is the Reply URL in RC backend ➔ Authentication ➔ External Authentication.

The Reply URL is automatically generated when you select ‘OAuth2 with AD FS’ option in RC backend  Authentication.

The URL for receiving logout details from ADFS must have the following format:

[RC backend URL]/Api/Authentication/Logout

e.g., http://ResourceCentral.com/Api/Authentication/Logout

Then click [OK] to proceed.

5. On the next screen (Configure Application Credentials), check on “Generate a shared secret” and click “Copy to clipboard” save the client secret then click “Next”.

6. On Configure Web API screen, fill in “Identifier” (which is Client Id in Step 4 of this section) and click [Add] button.

Then click [Next] to proceed.

7. Click [Next] on Choose Access Control Policy screen.

8. On Configure Application Permissions screen, check on openid and user_impersonate checkboxes.

Click [Next] proceed.

9. Click [Next] on Summary screen and click [Close] on Complete screen to finish.

NOTE: If, in the system, there are users who have User Principal Name different from SMTP address, we need to add claim to retrieve all email addresses. Please refer to ‘Adding claim to retrieve all email addresses for users who have UPN different from SMTP’ article for more details.

Part B. Retrieve details for OAuth2 with ADFS Authentication Protocol

Reply URL

Refer to Step 4 from Part A for more details.

Client Id

The Client Id can be retrieved from Step 4 in Part A of this protocol.

Client Secret

The Client Secret can be retrieved from Step 5 in Part A of this protocol (highlighted in Green).

Authorization URL, Token URL and Logout URL

Go to the following link: 

https:///adfs/.well-known/openid-configuration

And a json file (openid-configuration.json) will be available for you to download/view. If you download it, open this file with Notepad or Notepad++, look for the necessary information as described in the following table:

URLKeywords to look for in the json file
Authorization URL
authorization_endpoint
Token URL
token_endpoint
Logout URL
end_session_endpoint

Copy the URL, remove the character “\” in each URL and paste into the relevant fields in RC backend.

Claim Mapping

NOTE: Claim Mapping section is used only when Role Based Access Control (RBAC) function is enabled.

In the Claim Mapping part, the Resource Central information in the left column (Identity Attribute) can be mapped to Token Azure IDP information in the right column (Claims).

In the Claims column, you can customize the information to your purpose and then map it to the compatible Identity Attribute column.

Properties

Applies toRC 4.3+

Reference: TFS #339238

Knowledge base ID: 0319

Last updated: Jun 14, 2023

Was this article helpful?

That’s Great!

Thank you for your feedback

Sorry! We couldn't be helpful

Thank you for your feedback

Let us know how can we improve this article!

Select at least one of the reasons
CAPTCHA verification is required.

Feedback sent

We appreciate your effort and will try to fix the article