Configuring Microsoft ADFS Parameters
ADFS requires Gemini 6.8.1 or higher
- An official SSL certificate (not self signed) for ADFS Signing should already been purchased.
- ADFS 3.0 with WS-Federation must already be already installed.
- ADFS must be configured to use the official certificate.
- When referring to the final URL/Parameters of Gemini Website, the correct title case is required. Reference the IIS server Site setup and use the correct URL!
https://countertest.countert.com/gemini/ is not equal to https://countertest.countert.com/Gemini/ and will fail.
Step 1 - Configuring Relying Patry Trusts
Go to: ADFS Management > Trust Relationships > Relying Party Trusts > Add Relying Party Trust and Click Start
Choose Enter data about the relying party manually.
Set the Display name and you can set Notes for this relying party.
Choose ADFS profile.
Click Enable support for the WS-Federation Passive protocol URL and set the Relying party URL.
If all is OK, the Relying party URL will appearin the list. You can add another one with the Add button.
Click Next with Permit all users to access this relying party.
Step 2 - Configuring Claim Rules
Click Add Rule.
Choose Transform an Incoming Claim.
Set the claim rule name to SID. Choose Primary SID in the Incoming claim type and Outgoing claim type. Click Finish.
Set the claim rule name to Domain/name. Choose Windows account name in the Incoming claim type and Outgoing claim type. Click Finish.
Customizing the ADFS sign-in experience
Using Windows PowerShell, you can change the General ADFS sign-in page: for example the company name, company logo, you can add descriptions and links, etc.
Please configure the following, if you want to allow non ADFS configured people to use the original username password based logon screen of Gemini. This will allow users to bypass ADFS authentication.
With the following PowerShell script, add the Gemini Login link to the ADFS Sign-in page. Run the Windows PowerShell script with Administrator elevated privileges.
Replace this value: https://countertest.countert.com/gemini/ to the valid URI of your installed Gemini application in the script and execute:
Set-AdfsGlobalWebContent -SignInPageDescriptionText "<p>Use gemini login <A href='https://countertest.countert.com/gemini/'>here</A></p>"
Example Configuration of Keep Me Signed In KMSI possibility for users in PowerShell
Set-AdfsProperties -EnableKmsi $True
Configuring the lifetime (minutes) for KMSI with the next script
Set-AdfsProperties -KmsiLifetimeMins 1400
Configuring Gemini Parameters
Please use regular Gemini upgrade procedures to deploy the application changes to your existing Gemini installation. Your database will automatically be upgraded when starting the new Gemini version.
Step 1 - Configuring the System Parameters : Authentications
Go to: Customize > System > Authentications
Check Enable ADFS. Make sure you restart IIS server after modifying this parameter!
Federation metadata URL: Provide Gemini with the URL of the federationmetadata.xml coming from your ADFS server.
Log errors: We recommend you check this to log ADFS related errors in Gemini System log.
Step 2 - Configuring Users
Go to: Customize > People > Users
When ADFS is Enabled the User form will show 2 new fields for ADFS.
Edit users to set all necessary parameters.
ADFS SID: the user account SID in the originating domain
Lock user data: The following data is not updated on the user from domain when checked: e-mail, firstname, surname from ADFS synchrinization.
The ADFS SID field and Username field (format: ADFSDomain\username) must be filled from the source domain to make a successful ADFS authentication.
Step 3 - 4. Configuring web.config
You can turn ADFS authentication off and on by web server.
In the appSettings section in web.config there is a parameter: gemini.adfsenabled.
If the value is true, or does not exist, ADFS authentication is enabled on this web server for the given gemini site.
Swiching this value to false means gemini ADFS authentication is not enabled on this web server for the given gemini site, even though ADFS Enabled is true in Gemini database.