HTTP Commander  AJS 4.x
Manual

Note! This Manual is for the "Windows authentication" version, which is designed to work with existing Windows server or Active Directory accounts and Windows authentication. If you want to create accounts by yourself and store their credentials in your own HTTP Commander XML database, you need to download the "Forms authentication" version! This Manual is for the Windows authentication version only!

Web file manager
Free Installation assistance
Manual Home page

HTTP Commander ADFS integration.

Note !
We offer free installation assistance for both trial and commercial licenses. You can get help via email, instant messenger or via remote access to your server. You need few minutes to get online help.

Often Enterprise customers use ADFS in their networks for Single Sign On. Http Commander can be configured for work with Microsoft Windows Active Directory Federation Services.
Requirements
  1. Microsoft Windows Active Directory with Domain Controller
  2. Microsoft Active Directory Federation Services server.
We assume that DC, ADFS and Web server already installed and function correctly.
Also AD version of Http Commander should be installed on Web server. And Web server should have SSL certificate installed and HTTPS binding configured.
You will need to have Administrative access to Domain to complete this configuration .

This tutorial is splitted into several sections.

Steps to configure Web server for ADFS authentication

  1. First of all, make sure that you have .NET Framework 3.5 and Windows Identity Foundation features installed on your server.
    Install them, if they are not installed.
    Http Commander itself work with .NET 4.0 (including 4.5), but Windows Identity Foundation feature require .NET 3.5 .
    Show screenshot
  2. Create a service account in Active Directory to run the C2WTS service under. In this example, we have created 'element-it\svcC2WTS'.
  3. Next, configure the required local server permissions that the C2WTS requires. Log onto the web server and give the C2WTS the following permissions:
    1. Add the service account (element-it\svcC2WTS) to the local Administrators Groups.
    2. In local security policy (secpol.msc) under user rights assignment give the service account (element-it\svcC2WTS) the following permissions:
      1. Act as part of the operating system
      2. Impersonate a client after authentication
      3. Log on as a service

    Show screenshot
  4. Open services manager (services.msc) and find "Claims to Windows Token Service". Open its properties and change startup type to "Automatic".
    Next, switch to "Log on" tab and set logon account to domain service account we created previously ( element-it\svcC2WTS ).
    Show screenshot
  5. Now we need to configure C2WTS service.
    c2WTS requires the 'callers' identities explicitly listed in the configuration file, c2WTShost.exe.config (\Program Files\Windows Identity Foundation\v3.5\c2WTShost.exe.config).
    c2WTS does not accept requests from all authenticated users in the system unless it is configured to do so. In this case the 'caller' is the HttpCommander application pool identity : IIS APPPOOL\htcomnetpool.
    Show screenshot
  6. There is a known issue with the C2WTS where it may not automatically startup successfully on system reboot. A workaround to the issue is to configure a service dependency on the Cryptographic Services service:
    Open the Command Prompt window.
    Type: sc config "c2wts" depend= CryptSvc

Steps to configure Http Commander for ADFS authentication

  1. Configure HTTP Commander application pool to load user profile.
    Open IIS management console: Control panel->Administrative tools-> Internet Information Services-> and then "Application pools".
    Open "Advanced settings" of htcomnetpool application pool. Change to true the value of the "Load User Profile" setting.
    Show screenshot
  2. We are ready to configure HttpCommander. Open web.config file in editor.
    Add microsoft.identityModel section to configSections: 
    			<configSections>
				<section name="HttpCommanderSettings" type="HttpCommander.HttpCommanderSettings" allowLocation="true" allowDefinition="Everywhere" restartOnExternalChanges="false" />
				<!-- ADFS integration-->
				<section name="microsoft.identityModel" type="Microsoft.IdentityModel.Configuration.MicrosoftIdentityModelSection, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
				<!-- ADFS integration END-->
			</configSections>
  3. Add microsoft.identityModel assembly to compilation section: 
    			 <compilation debug="true" targetFramework="4.0">
			  <!-- ADFS integration-->
			  <assemblies>
				<add assembly="Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
			  </assemblies>
			  <!-- ADFS integration END-->
			</compilation>
  4. Disable authentication. Replace existing authentication tag with following one: 
    			<!-- ADFS integration-->
				<authentication mode="None" />
			<!-- ADFS integration END-->
  5. Append requestValidationMode="2.0" attribute to the httpRuntime section. 
    			<httpRuntime maxRequestLength="2097151" executionTimeout="3600" requestPathInvalidCharacters="" requestValidationMode="2.0" />
  6. Add IdentityModel http modules at system.web section. 
    			 <!-- HTTP Module for WebDav access and Office edit -->
			<httpModules>
			  <add name="FileWebDavModule" type="HttpCommander.FileWebDAVServer.FileWebDavModule, FileWebDAVServer" />
			  <!-- ADFS integration-->
			  <add name="SessionAuthenticationModule" type="Microsoft.IdentityModel.Web.SessionAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
			  <add name="WSFederatedAuthenticationModule" type="Microsoft.IdentityModel.Web.WSFederatedAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />			 
			  <!-- ADFS integration END-->			 
			</httpModules>
  7. Add IdentityModel modules at system.webServer section. 
    			<modules runAllManagedModulesForAllRequests="true">
			  <remove name="FileWebDavModule" />
			  <remove name="WebDAVModule" />
			  <add name="FileWebDavModule" type="HttpCommander.FileWebDAVServer.FileWebDavModule, FileWebDAVServer" preCondition="integratedMode" />
			  <!-- ADFS integration-->
			  <add name="SessionAuthenticationModule" type="Microsoft.IdentityModel.Web.SessionAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler" />
			  <add name="WSFederationAuthenticationModule" type="Microsoft.IdentityModel.Web.WSFederationAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler" />     
			  <!-- ADFS integration END-->
			</modules>
  8. Add microsoft.identityModel section to the configuration section right after system.webServer.
    Here you will need to replace https://webserver.element-it.local/htcomnet/default.aspx with url to Http COmmander on your server and https://adfs.element-it.local/adfs with url to your ADFS server.
    Also you should replace the value of the thumbprint attribute with the thumbprint of Token Sign certificate of your STS server.
    How to obtain thumbprint:
    1. Open AD FS 2.0 Management > Service > Certificates then right-click on the Primary Token-signing certificate and choose View certificate.
    2. Click on the details tab to view and record the thumbprint from the Thumbprint field. An example of a thumbprint is: 77 5D 64 8E 73 62 C7 69 45 97 DB 5B BD 39 16 C5 F2 76 8C C1.
      NOTE: when you use the clipboard to copy-and-paste a certificate thumbprint, you may get an invisible Unicode garbage character. Make sure that you did not selected any extra "space" at the beginning of the thumbprint.
      Alternate way is to execute following PowerShell script (on ADFS server) to export thumbprints into CSV file:
      Get-AdfsCertificate | Select-Object CertificateType, Thumbprint | Export-Csv -Path C:\temp\adfsthumbs.csv -Encoding ASCII -NoTypeInformation 


    			 <!-- ADFS integration-->
			  <microsoft.identityModel>
				<service saveBootstrapTokens="true">
				  <applicationService>
					<claimTypeRequired>          
					  <claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" optional="true" />
					  <claimType type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" optional="true" />
					  <claimType type="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" optional="true" />          
					</claimTypeRequired>
				  </applicationService>
				  <securityTokenHandlers>
					<remove type="Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
					<add type="Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
					  <sessionTokenRequirement useWindowsTokenService="true" />        
					</add>
					<add type="Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
					  <samlSecurityTokenRequirement mapToWindows="true" useWindowsTokenService="true" />        
					</add>
				  </securityTokenHandlers>
				  <certificateValidation certificateValidationMode="None" />
				  <audienceUris>					
					<add value="https://webserver.element-it.local/htcomnet/default.aspx" />
				  </audienceUris>
				  <federatedAuthentication>
					<wsFederation passiveRedirectEnabled="true" issuer="https://adfs.element-it.local/adfs/ls/" realm="https://webserver.element-it.local/htcomnet/default.aspx" requireHttps="true" />
					<cookieHandler requireSsl="true" />
				  </federatedAuthentication>
				  <issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
					<trustedIssuers>
					  <add thumbprint="775D648E7362C7694597DB5BBD3916C5F2768CC1" name="http://adfs.element-it.local/adfs/services/trust" />
					</trustedIssuers>
				  </issuerNameRegistry>
				</service>
			  </microsoft.identityModel>  
			  <!-- ADFS integration END-->
  9. Finally your web.config should look like this one:
  10. Configure Logout.aspx page to force logout from adfs.
    Open Logout.aspx page in text editor.
    Search for if (Utils.UserSettings.Runtime.AuthMode == AuthenticationMode.Forms) statement,
    navigate to the end of the appropriate else statement and add following line of code:
    Response.Redirect("https://adfs.element-it.local/adfs/ls/?wa=wsignout1.0&wreply="+redirectUrl);
    Where adfs.element-it.local domain should be replaced with domain name of your RP STS server.
  11. If you plan to use public links and online viewers, it is necessary to configure anonymous access to /Handlers/AnonymousDownload.ashx handler.
    Open Global.asax file in text editor and add following code to it :
    Append to the inport section on the top of the file: 
                    <%@ Import Namespace="Microsoft.IdentityModel.Web" %>

    Add event handler function: 
                        void WSFederationAuthenticationModule_AuthorizationFailed(object sender, AuthorizationFailedEventArgs e)
                    {                        
                        if (Request.Path.EndsWith("/Handlers/AnonymousDownload.ashx"))
                        {
                            e.RedirectToIdentityProvider = false;
                        }
                    }

    And subscribe to the AuthorizationFailed event in the Application_Start function: 
                        protected void Application_Start(object sender, EventArgs e)
                    {		
		                FederatedAuthentication.WSFederationAuthenticationModule.AuthorizationFailed += WSFederationAuthenticationModule_AuthorizationFailed;
		                ...
                    }
  12. As last step, you will need to set correct value for the LDAPConatiner setting either in HttpCommanderSettings.config file or on Settings tab in Admin Panel. This is required to get user group membership and home directory from AD.

Steps to configure Relying Party Trust on ADFS server

  1. Open AD FS management console and navigate to Trust Relationships, Relying Party Trust section of left tree.
    Click on Add Relying Party Trust to start wizard.
  2. Choose option Enter data about the relying party manually
    On next screen enter Name of relying party (any value),
    On next screen select option "AD FS profile"
    Show screenshot
  3. Check options Enable support for the WS-Federation Passive protocol and Enable support for the SAML 2.0 WebSSO protocol.
    For both options set full url to Http Commander application. In our case it is "https://webserver.element-it.local/htcomnet/default.aspx"
    Show screenshot
  4. Relying party identifier should be already added to the list. So you can simply proceed to next step.
    Show screenshot
  5. Complete wizard with next several screens following on-screen suggestions.
    Choose option Permit all users to access this relying party
    Show screenshot
  6. Configure Claim rules.
    Choose option Send LDAP attributes as claims
    Show screenshot
  7. Only UPN claim is required to be configured for correct work.
    Configure it as shown on screenshot.
    Show screenshot
  8. Now configuration is complete and we are ready to test Http Commander. If all configured correctly , after authentication Http Commander interface should be loaded. Open diagnostics.aspx page and check its output . Make sure that application works under logged in user identity (impersonated ).
    If you plan to use Network shares, process to next section.

Steps to configure Delegation for correct work with Network Shares

Once authenticated HttpCommander will work under logged in user identity , It means that all existing NTFS ACLs will be respected, but only for local folders on Web server.
If you plan to use Netwrok Shares (that is common practice), you will need to configure Delegation for web server and service account.
  1. Add an arbitrary Service Principal Name (SPN) to the service account to expose the delegation options for this account in Active Directory Users and Computers. The SPN can be any format because we do not authenticate to the C2WTS using Kerberos authentication. It is recommended to not use an HTTP SPN to avoid potentially creating duplicate SPNs in your environment. In our example, we registered SP/C2WTS to the element-it\svcC2WTS account using the following command: 
    			SetSPN -S SP/C2WTS element-it\svcC2WTS
    Please note that command should be executed under domain admin account.
  2. Configure delegation for web server.
    Show screenshot
  3. Configure delegation for service account (element-it\svcC2WTS)
    Show screenshot