Setup Azure MFA User Portal for Self Service
Setup Azure MFA user portal for self serviceÂ is the next step, after setting up Azure MFA Server. Using the user portal, users can enroll and maintain their account.Â They will demand less support from your support team or admins. User will be able to change their PIN, change security questions, change phone number, enroll for the app, choose authentication methods, etc. The user portal runs on Internet Information Services (IIS), it’s a website.
Deliverables of this post:
- Setup Azure MFA User Portal.
Requirements for the configuration:
- Windows 2016 Server running IIS and MFA Server.
- Azure subscription.
- Valid SSL certificate.
- Active Directory for user authentication.
- A hostname for the MFA Server, in my case https://mfa.vikash.nl. This must match your SSL certificate.
MFA User Portal has a lot of options and features. In this blog I will only show a few. Check your requirements and enable features accordingly. In my homelab I have MFA Server and the User Portal running on the same Windows Server.
Setup IIS for MFA User Portal
I will start by configuring IIS to make sure that deploying the user portal goes smooth later on.
StartÂ IIS Manager, click onÂ Application Pools and select theÂ DefaultPool. Then click onÂ Basic Settings in the right column.
Change theÂ .NET CLR version toÂ v2.0.50727. Then selectÂ Classic inÂ Managed pipeline mode. Click onÂ OK.
Now selectÂ Default Web Site and selectÂ Bindings in the right column.
Click onÂ Add.
SelectÂ https and then your SSL certificate for the website. Make sure that this is the certificate with the correct DNS hostname for your MFA Server. Click then onÂ OK.
Check then the binding is correct and click onÂ Close.
Install Web Service SDK
Now go back to your MFA Server interface and selectÂ Web Service SDK.Â Then click onÂ Install Web Service SDK.
Click onÂ Next.
Click again onÂ Next to continue.
Keep the defaults and click on Next.
After the installation finishes, click onÂ Close.
Start IIS manager andÂ selectÂ MultiFactorAuthWebServiceSdk and click onÂ Authentication.
DisableÂ Anonymous Authentication.
Setup and configure the User Portal
Now it is time to install and configure the user portal. Go to theÂ User Portal and select the options you want to enable for your users. Then click onÂ Install User Portal.
Select the defaults and click onÂ Next.
After installation finishes click onÂ Close.
Let’s test if this is working. Open a browser and go to https://<ExternalFQDN>/MultiFactorAuth/. In my case this is https://mfa.vikash.nl/MultiFactorAuth. You should see the MFA User Portal Log In page.
Setup and configure the Mobile Portal
The interface doesn’t have a option to install the Mobile Portal. We need to locate the installer in the folderÂ C:\Program Files\Multi-Factor Authentication Server. Select the fileÂ MultiFactorAuthenticationMobileAppWebServiceSetup64.msi.Â
Start the installer and accept the defaults. Click onÂ Next.
After the installer finishes, click onÂ Close.
Now we have to make sure that the MFA Server knows what theÂ Mobile App Web Service URL is. Go toÂ Mobile App and enter the URL:Â https://<ExternalFQDN>/MultiFactorAuthMobileAppWebService. In my case this isÂ https://mfa.vikash.nl/MultiFactorAuthMobileAppWebService. TheÂ Account name can be anything you like.
Configure Service Account
The User Portal installer creates an Active Directory group. The name is:Â PhoneFactor Admins. Let’s create an account and use is as an service account.
OpenÂ Server Manager. Click onÂ Tools and thenÂ Active Directory Administrative Center.
I have a specific containerÂ Service Accounts. Select the container where you want to create your serviceÂ account and then click onÂ New -> UserÂ in the right column.
Enter the details according to your requirements. Make sure to set theÂ Password options toÂ Never expires. Then click onÂ Member Of.
Click onÂ Add.
Find theÂ PhoneFactor Admins group and click onÂ OK.
Then click onÂ OK.
Configure Service Account forÂ Application Pool
Next step is to configure the different components of Azure MFA User Portal to use the service account we just created.
Go to IIS manager, selectÂ Application Pools then click onÂ MultifactorAuthWebServiceSdk application pool. Then click onÂ Advanced Settings in the right column.
UnderÂ Process Model selectÂ Identity. Click on the button with the 3 dots.
SelectÂ Custom account and click onÂ Set.
Enter the credentials of the service account you created and click onÂ OK.
Make sure the service account is selected and click onÂ OK.
Make sure the service account is selected now and click onÂ OK.
Configure Service Account for Mobile Portal
Now we have to configure the Mobile Portal to use the service account. This has to be done in the config file.
Run Notepad as Administrator. Open the web.config fileÂ located inÂ C:\inetpub\wwwroot\MultiFactorAuthMobileAppWebService.
Locate the sectionÂ appSettingsÂ section. Change the value ofÂ WEB_SERVICE_SDK_AUTHENTICATION_USERNAMEÂ andÂ WEB_SERVICE_SDK_AUTHENTICATION_PASSWORDÂ to match the information of your service account.
And as long we are here in this file locate the sectionÂ applicationSettings. Change the value there to match youÂ ExternalFQDN. In my case that isÂ https://mfa.vikash.nl/MultiFactorAuthWebServiceSdk/PfWsSdk.asmx. Then save the config file.
Do some testing
Now we can do some testing and see of the service account is fine for the Mobile Portal. Open a browser on your MFA Server and navigate toÂ https://localhost/MultiFactorAuthMobileAppWebService. Click onÂ Continue if you get the certificate error. Then click onÂ TestPfWsSdkConnection.
Click onÂ Invoke to start the test.
You should see theÂ Success value if everything is correct.
Go back toÂ https://localhost/MultiFactorAuthMobileAppWebService. Click onÂ Continue if you get the certificate error. Then click onÂ TestSecurity.
Click onÂ Invoke to start the test.
If everything is fine it should return te valueÂ secure.
Configure Service Account for User Portal
Now we have to configure the UserÂ Portal to use the service account. This has to be done in the config file.
Run Notepad as Administrator. Open the Web.Config fileÂ located in C:\inetpub\wwwroot\MultiFactorAuth.
Locate the sectionÂ appSettings section. Change the value of USE_WEB_SERVICE_SDK to true.Then change the value ofÂ WEB_SERVICE_SDK_AUTHENTICATION_USERNAMEÂ andÂ WEB_SERVICE_SDK_AUTHENTICATION_PASSWORDÂ to match the information of your service account.
Then scroll down and locate the sectionÂ applicationSettings. Change the value there to match yourÂ ExternalFQDN. In my case this isÂ https://mfa.vikash.nl/MultiFactorAuthWebServiceSdk/PfWsSdk.asmx.
Test MFA User Portal
After setting everything up it is now time to test the whole setup. Open a browser and navigate to your MFA User Portal. Remember to access it on theÂ ExternalFQDN. In my case that isÂ https://mfa.vikash.nl/MultiFactorAuth/. Enter the username and password for a user which is enabled for MFA. The click onÂ Log In.
Azure MFA will call the user. Answer it.
Then click on the #Â key to accept the authentication request.
Now you can activate the mobile app with the correct information. Click onÂ Activate Mobile App and then click onÂ Generate Activation Code
You will now be presented with the activation page and the correct URL to activate the mobile app.
This concludes this blog post. Feel free to contact me of you have any questions or comments.
You can follow me on twitter or add the RSSÂ feed from myÂ blog and you will be notified when I add new posts.Setup Azure MFA User Portal for Self Service Read More