1On the Windows Server run the Server Manager, Add Roles and Features. Please check the following options additionally to those selected per default already:

1. Server roles:
   • Active Directory Domain Services
   • Active Directory Federation Services
   • Web Server (IIS)
2. Features:
   • .NET Framework 4.5 (4.6 on Windows Server 2016) Features
     • ASP.NET 4.5
3. Role services for Web Server (IIS)
   • Application Development
     • ASP.NET 4.5 (4.6 on Windows Server 2016)

2Promote the server to a domain controller if not done already.

3Install a recent Oracle Java run time enviroment from: https://java.com/

4Add the SecSign ID user attribute to the Active Directory: https://www.secsign.com/two-factor-authentication-in-active-directory/

5Import a certificate for HTTPS on the Windows Server.

• Copy your private key and https certificate bundled in a p12 file (pfx) to the server and double-click it.
• Select “Local Machine” as store location.
• Confirm the suggested options and confirm to install the certificate.

6Install the imported certificate for HTTPS at the Web Server (IIS).

• Click the Windows start menu and then click “Windows Administrative Tools”.
• Double-click the Internet Information Services (IIS) Manager.
• Right-click the web site in the list on the left side.
• Select Edit Bindings.
• Add “https” and select the TLS (SSL) certificate.

7 Sign up for a free trial (or a paid subscription) of Microsoft Office 365 at: https://products.office.com/en-us/business/office-365-business-premium

• Go to the Office 365 Admin center at: https://portal.office.com/adminportal/home#/homepage
• Add a Domain.
• Software installation (like Microsoft Word) and e-mail address migration are not required to set up the SecSign ID federation.
• Select “I’ll manage my own DNS records.”
• None of the DNS entries suggested by Microsoft are required just to set up the SecSign ID federation. Select “Exit and continue later”.

8 Install “Microsoft Azure Active Directory Connect” from: http://www.microsoft.com/en-us/download/details.aspx?id=47594

• Use customized settings.
• Do not check anything at “Install required components”.
• In “User sign-in” select: “Federation with AD FS”.
• In “Connect to Azure AD” enter your credentials from the Office 365 sign-up.
• In “Connect your directories” select your forest and enter your Windows administrator credentials.
• In “Azure AD sign-in configuration” select “userPrincipalName”.
• In “Domain and OU filtering” select “Sync all domains and OUs”.
• In “Uniquely identifying your users” select that “Users are represented only once across all directories” and select objectGUID as source anchor.
• In “Filter users and devices” select “Synchronize all users and devices”.
• Do not select any optional features.
• In “AD FS Farm” load your private key and certificate from a p12 file (pfx) and select a subject name. This must be a host name in the public DNS pointing to this server.
• In “AD FS Servers” select your Windows Server.
• Skip the installation of a Web application proxy server.
• Enter you Domain administrator credentials in the next dialog.
• Enter the same credentials again in “AD FS service account”.
• Select your Azure AD domain.
• Select to start the synchronization process, do not select staging and click “Install”.
• Create the necessary DNS entries or just exit and do it later as needed.

9 Install “Active Directory module for Windows Powershell”. (On a domain controller this is installed already.)

• Run the Server Manager and open the “Add Roles and Features Wizard”.
• In the “Features” dialog unfold: Remote Server Administration Tools, Role Administration Tools and select: Active Directory module for Windows Powershell

10 Install “Azure Active Directory Connection” from: http://connect.microsoft.com/site1164/Downloads/DownloadDetails.aspx?DownloadID=59185 and download & install AdministrationConfig-V1.1.166.0-GA.msi

11 Install SecSign ID Federation SAML generator.

• Run SecSign-ID-Federation-SAML-Generator-Setup.exe.
• Copy the pfx or p12 file containing your SAML response signing key to the folder FederatedSecSignID
• Run regedit.exe and open the registry key:
  HKEY_LOCAL_MACHINE\SOFTWARE\SecSign\ADFS
• Edit the value of SamlResponseSigningKeyPassword and type the password of your SAML response signing key.
• Edit the value of SamlResponseSigningKeyFile to the path and file name of your SAML response signing key.
• Edit the values of SecSignIDServerHostName and SecSignIDServerPort to match your SecSign ID Server.
• Edit the values of FallbackSecSignIDServerHostName and FallbackSecSignIDServerPort to match your fallback SecSign ID Server.
  If you do not have a fallback server then please leave ‘-‘ as the value of FallbackSecSignIDServerHostName.
• Edit the value of ServiceNameForSecSignApp. This description of the service will be displayed in the SecSign App during the log-in.

12 Configure the federation properties by running these commands in a Powershell:

• Extract your SAML signing certificate from a p12 file (pfx):
  Get-PfxCertificate -FilePath .p12 | Export-Certificate -FilePath secsign.cer
• Base64 encode the certificate by running this command in a PowerShell window:
  $SECSIGNSAMLSIGNCERT = [convert]::ToBase64String((get-content secsign.cer -encoding byte))
• Enter your credentials for the Microsoft Office 365 admin web site: connect-MsolService
• Turn off federation temporarily to make sure that the following command will actually upload your SAML signing certificate:
  Set-MsolDomainAuthentication -DomainName -Authentication Managed
• Set the federation settings of your domain in Microsoft Azure:

  $Domain = “”
  $ActiveLogOnUri = “https:///adfs/services/trust/2005/usernamemixed”
  $FederationBrandName = “SecSign”
  $IssuerUri = “https:///FederatedSecSignID/SecSignIDLogin.aspx”
  $LogOffUri = “https:///adfs/ls/”
  $MetadataExchangeUri = “https:///adfs/services/trust/mex”
  $PassiveLogOnUri = “https:///FederatedSecSignID/SecSignIDLogin.aspx”

  Set-MsolDomainAuthentication –DomainName $Domain -IssuerUri $IssuerUri -LogOffUri $LogOffUri -PassiveLogOnUri $PassiveLogOnUri -ActiveLogOnUri $ActiveLogOnUri -FederationBrandName $FederationBrandName -MetadataExchangeUri $MetadataExchangeUri -SigningCertificate $SECSIGNSAMLSIGNCERT -Authentication Federated

• Should you ever need to remove users of an already removed test domain from Azure and the Office 365 admin panel doesn’t allow you to do so you may use:

  Remove-MsolUser –UserPrincipalName

  More details here:
  https://support.microsoft.com/en-us/kb/2709902