Install-SecureMfaOtpProvider.ps1
|
<#
.SYNOPSIS Installs SecureMFA.com MFA OTP authentication provider for ADFS. .DESCRIPTION Deployment must be done from elevated PowerShell command window If you are using federation server farm that uses Windows Internal Database, you must start installation using the primary federation server of the farm as a MAIN node. Installation needs to be executed on ADFS farm server (not web application proxy servers). Dependencies: * System which executes a script must have Microsoft Framework 4.6.1 and above installed. * SecureMfaOtpProvider.dll file must be present in script directory. * SecureMfaOtpProvider.json configuration file must be present in script directory. Bellow is a sample of valid Json config file with minimal configuration required for installation: { "company": "MyCompany", "serialkey": "m00000000", "sqlserver": "asqlaol1.adatum.labnet,1433", "sqldbname": "SecureMfaOTP", "sqlintegratedsecurity": "true", "sqluseraccount": "", "sqluserpassword": "", "verboselog": "false", "data_encryption": "false", "encryption_passphrase": "d9GhT=7=Ox8-+LaZ", "login_failures": "0", "lockout_minutes" : "5", "ui_customization": "false", "ui_first_login_text": "", "ui_login_text": "", "ui_allow_qr_display_from_networks": "10.0.0.0/255.0.0.0;172.16.0.0/255.255.0.0;192.168.0.0/255.255.0.0", "totp_customization": "false", "totp_remove_user_prefix": "false", "totp_offline_qr_enable": "true", "totp_offline_qr_algorithm": "SHA1", "totp_offline_qr_period": "30", "totp_api_endpoint": "https://chart.googleapis.com/chart?chs=150x150&cht=qr&chl=otpauth://totp/", "totp_api_otpauth_advanced_params": "&algorithm=SHA1", "totp_image_width_pixels": "150", "totp_image_height_pixels": "150", "auth_mode": "MSSQL" } .PARAMETER NotMainNode NotMainNode parameter is required when you do installation on multiple ADFS nodes (not web application proxy servers). This needs to be executed on other adfs servers when installation of a provider is done on the MAIN(First) ADFS node. .NOTES Version: 1.0.1.5 Author: SecureMfa.com Creation Date: 26/08/2019 Purpose/Change: Incorporated into module .EXAMPLE C:\PS> Install-SecureMfaOtpProvider This command will install OTP authentication provider on the MAIN ADFS node. .EXAMPLE C:\PS> Install-SecureMfaOtpProvider -NotMainNode This command will install OTP authentication provider on OTHER ADFS node(s). #> $dllpath = (Join-Path -Path $PSScriptRoot -ChildPath SecureMfaOtpProvider.dll) $configpath = (Join-Path -Path $PSScriptRoot -ChildPath SecureMfaOtpProvider.json) #Check if windows events source for application log exist, if not create one. if ([System.Diagnostics.EventLog]::SourceExists("Secure MFA OTP") -eq $False) {New-EventLog -LogName "Application" -Source "Secure MFA OTP"} #Load GAC Assembly Set-location $PSScriptRoot [System.Reflection.Assembly]::Load("System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a") $publish = New-Object System.EnterpriseServices.Internal.Publish Function Install-SecureMfaOtpProvider { Param ( [Parameter(Mandatory=$false, ParameterSetName="Default")] [Switch]$NotMainNode ) #OTHER nodes install if ($NotMainNode) { write-host "Installing SecureMfaOtpProvider on the OTHER node" -ForegroundColor Cyan #Remove SecureMfaOtpProvider DLL from GAC assembly $publish.GacRemove($dllpath) #Add SecureMfaOtpProvider DLL to GAC assembly $publish.GacInstall($dllpath) #Restart ADFS service write-host "Restarting adfssrv service." -ForegroundColor Green Stop-Service adfssrv Start-Service adfssrv } #MAIN nodes install else { write-host "Installing SecureMfaOtpProvider on the MAIN node using configuration $configpath" -ForegroundColor Cyan #Remove additional authentication providers from ADFS global policy and unregister SecureMfaOtpProvider write-host "Removing additional authentication providers from ADFS global policy and unregistering SecureMfaOtpProvider." -ForegroundColor Green Set-AdfsGlobalAuthenticationPolicy -AdditionalAuthenticationProvider "" unregister-AdfsAuthenticationProvider -Name �SecureMfaOtpProvider� -Confirm:$false #Restart ADFS service write-host "Restarting adfssrv service." -ForegroundColor Green Stop-Service adfssrv Start-Service adfssrv write-host "Installing SecureMfaOtpProvider..." -ForegroundColor Green #Remove SecureMfaOtpProvider DLL from GAC assembly $publish.GacRemove($dllpath) #Add SecureMfaOtpProvider DLL to GAC assembly $publish.GacInstall($dllpath) #Register SecureMfaOtpProvider addapter $typeName = �SecureMfaOtpProvider.AuthenticationAdapter, SecureMfaOtpProvider, Version=1.0.1.6, Culture=neutral, PublicKeyToken=f818a38c51378814, processorArchitecture=MSIL� Register-AdfsAuthenticationProvider -TypeName $typeName -Name �SecureMfaOtpProvider� -ConfigurationFilePath $configpath #ADFS 2019 requires update to http security headers to allow display of images for QR code to be display from external source. #You can update allows source with exact URL instated of any location (*). if (Get-Command "Get-AdfsFarmInformation" -errorAction SilentlyContinue) { if ((Get-AdfsFarmInformation).CurrentFarmBehavior -ge 4) { Set-AdfsResponseHeaders -SetHeaderName "Content-Security-Policy" -SetHeaderValue "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src * data:;" ; (get-AdfsResponseHeaders).ResponseHeaders | fl ; } } #Restart ADFS service write-host "Restarting adfssrv service." -ForegroundColor Green Stop-Service adfssrv Start-Service adfssrv #Add SecureMfaOtpProvider as additional authentication provider in ADFS write-host "Setting SecureMfaOtpProvider as additional authentication provider in global authentication policy." -ForegroundColor Green Set-AdfsGlobalAuthenticationPolicy -AdditionalAuthenticationProvider "SecureMfaOtpProvider" } #List all authentication providers Get-AdfsAuthenticationProvider | select name } |