Axonius Documentation
  1. Connecting Adapters
  2. Adapters 1-A

Active Directory Federation Service (AD FS)

Types of Assets Fetched

  • All Application Extensions, Groups, All Application Extension Instances, SaaS Applications, Admin Managed Extensions, Application Addons, User Initiated Extensions, Admin Managed Extension Instances, Application Addon Instances, Application Keys, User Initiated Extension Instances

Before You Begin

Required Ports

Axonius must be able to communicate with the value supplied in ADFS Server via the following ports:

  • 135 (RPC)
  • 445 (SMB)
  • Random port in the range 1024-65535

Authentication Methods

The AD FS adapter supports the following authentication methods:

  • NTLM (default) — Standard Windows NTLM challenge-response authentication.
  • Kerberos — Kerberos-based authentication. When using Kerberos, the user name must be in the format username/domain/realm. Two additional optional fields are available: Kerberos AES Key and Kerberos Host (KDC).

APIs

Axonius uses the ADFS Module.

Required Permissions

The value supplied in User Name and Password must be able to execute PowerShell code which queries the ADFS server for information on the systems managed by that server. The configured user must have permission to run the following PowerShell commands:

  • Get-Service
  • Get-AdfsRelyingPartyTrust
  • Get-AdfsApplicationGroup

The value supplied in User Name and Password must have the following permissions in order to fetch assets:

  • Local admin permissions.
  • Access RPC on the ADFS server.
  • Execute PowerShell on the ADFS server and access the IPC$ share on the ADFS server.
  • Read and Write Access to ADMIN$ share on the ADFS server. Alternatively, create an 'axonius' folder inside the \localhost\ADMIN$\ directory and ensure the Axonius account has Full Permissions to read and write to this newly created folder.

Supported From Version

Supported from Axonius version 6.1

Setting Up AD FS to Work with Axonius

If your environment requires WMI port configuration or a custom Windows share, complete the steps described in Active Directory Initial Setup before connecting this adapter.

Connecting the Adapter in Axonius

  1. Navigate to the Adapter Catalog, search for Active Directory Federation Service (AD FS), and select the adapter.
  2. Click Add Connection.
  3. Provide the following parameters.

Required Parameters

  1. Authentication - Select the authentication method: NTLM (default) or Kerberos. If you select Kerberos, the following optional fields for authentication may be configured:
    • Kerberos AES Key (optional) - A cryptographic key, either 128 or 256 bits in length, used to secure communication by encrypting and decrypting messages exchanged between the client and the server.
    • Kerberos Host (KDC) (optional) - The Kerberos Key Distribution Center (KDC) that will be used to authenticate. If this parameter is not specified, the domain will be used.
  2. ADFS Server - The hostname of the domain controller with the ADFS service.
  3. User Name and Password - The credentials for a user account that has the Required Permissions to execute PowerShell code which queries the ADFS server for information on the systems managed by that server. When using Kerberos the user name must be in the format username/domain/realm.
Active Directory Federation Service (AD FS)

Optional Parameters

  1. Custom Share Name - The name of the Windows Share on the specified host, for example, AxoniusShare$. If you do not specify a name, the adapter will use Admin$. For more information, see Active Directory Initial Setup.
  2. Custom Files Directory - The name of the directory to use within the specified Share, for example, AxoniusDirectory. If you do not specify a name, the adapter will use axonius.
  3. Custom Working Directory - If file sharing is restricted in the domain, specify the physical path of the share specified in Custom Share Name.
  4. HTTPS Proxy - Connect the adapter to a proxy instead of directly connecting it to the domain.
  5. HTTPS Proxy User Name - The user name to use when connecting to the value supplied in ADFS Server via the value supplied in HTTPS Proxy.
  6. HTTPS Proxy Password - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.


Updated 22 days ago

Did this page help you?