Summary

This document will guide you through the steps to enable multi-factor authentication and Single-Sign On for Unit4 Agresso Business World applications.

System Requirements

• PhenixID Authentication Server 2.0 or higher
• Unit4 Agresso Business World installed
• Microsoft ADFS installed
• The end user client (web browser) must be able to reach PhenixID Authentication Services, Unit4 Agresso Business world and ADFS over https (443).
  NB! All traffic must be encrypted (https)! Http only is not allowed.
• Test user must reside in Unit4 Agresso Business World

Instruction

Overview

This document will guide you through the steps to enable multi-factor authentication and Single-Sign on for Unit4 Agresso Business World applications.

PhenixID Server acting as SAML IdP

1. Setup PhenixID Authentication Services as a SAML IdP using one of the Federation scenarios described here. (If the desired authentication method is not provided by a scenario, use the documentation for the SAML authenticator here)
2. Use sAMAccountName as Name ID attribute. (If not using AD, please consult PhenixID for configuration assistance).
3. Then export your SAML IdP metadata by going to the URL:
   https://<YourServerDomainName>/saml/authenticate/<authenticator_alias>?getIDPMeta
   and download the metadata to a xml file.

Configure ADFS

Add claims provider

We will add a claimsprovider by adding the SAML metadata. Two rules will be configured for the claimsprovider.

1. Start AD FS Management
2. Click Trust Relationships/Claims Provider Trusts
3. Right click and choose “Add Claims Provider Trust…”
4. Choose a method to import your metadata
5. Set Display name = “PhenixID IdP” , just click next
6. Click next until close

Add issuance rule

1. Right-click the newly added Claims Provider
2. Select “Edit claims rules”
3. Click Add rule
4. Template, “Pass Through or Filter an Incoming Claim”
5. Set a rule name = “Name ID”
6. “Incoming claim type” = Name ID
7. “Incoming named ID format” = Unspecified
8. Finish

Export metadata from ADFS

1. Open a web browser and go to the URL:
   https://<adfs_domain>/FederationMetadata/2007-06/FederationMetadata.xml
2. Save data to file (in this example we will refer to the name adfs_demo_FederationMetadata.xml)

Import metadata to IdP

1. Open PhenixID Configuration Manager and login
2. Go to Scenarios->Federation
3. Click the plus next to SAML Metadata upload
4. Enter a display name = “ADFS”
5. Upload the file downloaded in previous step.  (adfs_demo_FederationMetadata.xml)
6. Test the connection between ADFS and PhenixID Authentication Services:
   1. https://<adfs_domain>/adfs/ls/idpinitiatedsignon.
   2. Click “Sign in”
   3. You should now be redirected to PhenixID Authentication Services
   4. Authenticate
   5. You should now be redirected back to ADFS
   6. ADFS should now display “You are signed in” (text may differ depending on ADFS version running).

Unit4 Agresso Business World server configuration

1. Login to the Unit4 Agresso Business World server (RDP).
2. Open Unit4 Agresso Business World Management Console. Make sure you have the proper admin rights to make configuration changes.
3. Go to Computers->My Computer->Unit4 (name may differ)->Backoffice Data Sources->platform->Features->Web applications->Default web site->name of the unit4 web app you would like to protect with strong auth->Authentication.
4. Select type = Federated Authentication.
   
5. Enter the following values:
   1. Issuer Id: <Your ADFS issuer id>
      Fetch the id by:
      1. Login to ADFS Server
      2. Open AD FS Management
      3. Right click AD FS
      4. Select Edit federation properties
      5. Copy the Federation Service Identifier value. (Example: http://adfs.demo.phenixid.net/adfs/services/trust)
   2. Issuer thumbprint: <The thumbprint of the ADFS token signing certificate>
      Fetch the thumbprint by:
      1. Login to ADFS Server
      2. Open AD FS Management
      3. Click AD FS-> Service -> Certificates
      4. Doubleclick the Token-Signing certicate
      5. Click on details
      6. Select thumbprint
      7. Copy the value. (Example: 84ef954f23c301357c13c851d8bf95858e45255d).
         Depending on ADFS version the thumbprint may contains spaces (” “). If it contain spaces, remove all spaces.
   3. STS endpoint: https://<your_adfs_server_domain>/adfs/ls/
      Example value: https://adfs.demo.phenixid.net/adfs/ls/
   4. Realm: https://<your_unit4_agresso_server_domain>/<unit_4_agresso_web_application_name>/
      Example value: https://unit4.phenixid.net/BWorld/
   5. Requires https: Enable
   6. SSL Cookie: Enable
   7. Click Save
   8. Copy the Application Metadata link. This will be used in ADFS steps below.
   9. Click Claims mapping configuration
   10. Add a claims mapping:
       http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier   -> User ID

Set up trust between ADFS and RDWeb

1. Go to ADFS 2.0 Management
2. Click “Relying party trust”
3. “Add Relying Party Trust
4. Enter the URL to the metadata from Unit4 Agresso Business World. (Application Metadata link fetched above).
   (If ADFS can not reach the url, download the metadata to a file and import a file)
5. Enter display name = Unit4 Agresso Business World Web
6. Do NOT Configure MFA
7. Permit all users to access this relying party
8. Press next and then close
9. Add the following to Rules:
   Pass Through or Filter an Incoming Claim, enter rule name, Incoming claim type=Name ID, Incoming Name ID format=Unspecified
10. Then press Finish

Remove organization selector in ADFS

ADFS will by default always present Active Directory as a login option. PhenixID recommends to remove this option for Unit4 Agresso Business World using this configuration:

1. Login to ADFS server (RDP)
2. Open Powershell (as admin)
3. Run this command to always associate the RP (Unit4 Agresso Business World) with PhenixID SAML IdP:
   Set-AdfsRelyingPartyTrust -TargetName “Unit4 Agresso Business World Web” -ClaimsProviderName @(“PhenixID IdP”)
   

Test

1. Browse to Unit4 Agresso Business World web application (example: https://unit4.phenixid.net/BWorld/)
2. This should result in a redirect to ADFS server
3. This should result in a redirect to PhenixID Authentication Server
4. Authenticate
5. If authentication was successful, a redirect to ADFS should occur (with SAML assertion)
6. A redirect to Unit4 Agresso Business World should occur
7. The user should now be logged in.