Active Directory SSO | Communifire Documentation

On visiting your intranet, users will be prompted to log in with their username and password.

Internet Explorer

Chrome

Firefox

Note: To enable automatic login in Chrome and Firefox, Internet Explorer must be configured to pass credentials via group policy. See the setup guide below for how to configure automatic login in Windows.

Session expiration

By default, the session expires 30 days from the date of log in. You can control when the session expires using System Properties > FormsAuthPersistentCookieTimeOutInMinutes. By default this value is set to 43200, which is 30 days.

When the property MakePermanentCookieForThirdPartyLogin is set to true, a cookie is generated for the user that expires based on the value found in FormsAuthPersistentCookieTimeOutInMinutes. If MakePermanentCookieForThirdPartyLogin is set to false, the user will be logged out when the browser is closed.

Return to top

On visiting your intranet, users will be prompted to log in with their username and password.

Note: Automatic login is not supported on Mac.

Session expiration

By default, the session expires 30 days from the date of log in. You can control when the session expires using System Properties > FormsAuthPersistentCookieTimeOutInMinutes. By default this value is set to 43200, which is 30 days.

When the property MakePermanentCookieForThirdPartyLogin is set to true, a cookie is generated for the user that expires based on the value found in FormsAuthPersistentCookieTimeOutInMinutes. If MakePermanentCookieForThirdPartyLogin is set to false, the user will be logged out when the browser is closed.

Return to top

Users must use their Active Directory username and password to log into the app. The username must be entered as DOMAIN\username, where DOMAIN is the Active Directory domain name.

Return to top

A user is created in Communifire when the user logs in for the first time. You can add users to Communifire before they log in using the methods below.

Bulk import users

Pre-populate users before Active Directory setup or launch with Bulk Import Users . The Communifire usernames you create must match the usernames in Active Directory. Note that the domain (DOMAIN\username) is excluded when we create a user in Communifire. Only the username is stored.

Add users

Add users in Control Panel > People > Manage People > Add User . The Communifire username you create must match the username in Active Directory.

REST API

You can use our REST API to import users.

Adding Communifire administrator accounts

If Communifire administrator accounts are created before Active Directory is set up and the Communifire usernames match Active Directory usernames, the administrator accounts will sync with the corresponding Active Directory accounts. If not, you will need to re-configure permissions for the admin Active Directory accounts and remove the previous Communifire administrator accounts.

Return to top

Groups in Active Directory are imported to Communifire as top level Roles and assigned to users. You can use User Space Assignment Rules to automatically add users to spaces based on their roles. When a user is added to or removed from an Active Directory group, their Communifire roles are updated.

See the Configure Group Import section in the setup guide below for how to import Active Directory groups as Communifire roles.

Return to top

Any data can be imported from Active Directory, as long as there are corresponding User Profile Fields in Communifire. Attribute mappings must be added to Control Panel > System > Sync Active Directory Data > Mapping. Enter the outgoing claim type as the property name in Communifire. See the table below for common fields to import.

You can also use the REST API to import user data.

Profile pictures

You can prevent Active Directory profile pictures from being imported to Communifire to allow users to change their Communifire profile picture. Set System Properties > ADSyncProfilePicture to false.

Return to top

Active Directory imports user data when the user first logs in. User data is synced every 120 minutes by default. You can set the sync interval by editing ActiveDirectorySyncManagerInterval in System Properties . You can sync data immediately at anytime in Control Panel > System > Sync Active Directory Data > Sync Now.

Return to top

When a user is disabled in Active Directory, this information is not sent to Communifire. You can Delete User and delete their content or re-assign their content to another user or to the system anonymous user. You can also Ban User , which will prevent the user from logging in, but will retain their content.

Return to top

1. Go to Control Panel > System > System Properties and set ActiveDirectoryAuthEnabled to true.
2. In web.config (in the root directory), change the value on the line below from false to true.
   

   <modules runAllManagedModulesForAllRequests="true">

3. In web.config, remove the following line:
   

   <remove name="WindowsAuthentication" />

   This enables the Windows Authentication HTTP module.
4. Find the <authentication> section in the web.config file and set the mode to “Windows”.
5. Find the <authorization> section that denies access to “anonymous” users visiting the site.
   
   The code and screenshot below demonstrate what your web.config file should look like after following the steps above.
   

   <configuration>
   ...
   <system.web>
   ...
   <authentication mode="Windows" />
   <authorization>
     <deny users="?"/>
   </authorization>
   ...
   </system.web>
   ...
   </configuration>

   
   Note that the <deny users=”?”/> directive tells ASP.NET to deny access to the application to all “anonymous” users to the site (the “?” character means anonymous user). This forces ASP.NET to authenticate the user and ensures that any user accessing Communifire has an account in AD.
6. You can configure Active Directory integration through the WindowsADSettings.config file in the root of the Communifire application.
   
   Do not comment out any key mentioned above.

Export as PDF

Follow the steps below to enable the Export as PDF feature.

1. You must have a valid SSL certificate. Not self-signed.
2. Populate WindowsADSettings.config with an AD user the application can use to view the web page. For example:

    <!-- Set HttpAuthenticationUsername,HttpAuthenticationPassword of app pool user so that pdf converter can pass those credentials 
      to gerneate pdf else, it will show missing images and css in pdf.
      Double check the username/password, otherwise it will show missing images and css. -->
    <add key="HttpAuthenticationUsername" value="my.domain.com\Communifire"/>
    <add key="HttpAuthenticationPassword" value="@bcd1234"/>

Return to top

In IIS:

1. Open Internet Information Services (IIS) Manager.
2. Select the application pool of your website.
3. Set the application pool identity to "NetworkService".
   
   
4. Click OK.
5. Select your community website/virtual directory.
   
   
6. On the right side, click Authentication.
   
   
7. Disable all Authentication types except Windows Authentication and Basic Authentication.
   
    
8. Right click on Windows Authentication.
9. Select Providers.
10. Move NTLM to the top of the providers list.
    
    
11. Click OK.
12. Right click Windows Authentication.
13. Select Advanced Settings.
14. Turn Extended Protection off.
    
    
15. Click OK.
16. Go to the Communifire physical folder.
17. Right click on the Assets folder.
18. Select the Security tab.
19. Configure the permissions for all groups and users who will access your community:
1. Remove Full Control rights.
2. Grant Modify, List Folder Contents, Read, and Write permissions.

Return to top

This section provides instructions for configuring folder permissions in Windows to enable certain Communifire features and functions.

Configure folder permissions to enable file upload

1. In the site folder, navigate to the \Assets folder
2. Right-click the Uploaded-CMS-Files folder > Properties
3. Click Security
4. Click Edit
5. Select Domain Users
6. Check the Modify permission
   
7. Click OK
8. Click OK
9. Repeat the steps for the following folders:
   • Uploaded-Files
   • Uploaded-Photos
   • Uploaded-Videos

Configure folder permissions to enable the export as PDF feature

1. In the site folder, navigate to the \bin folder
2. Right-click the HiQPdf.dep file > Properties
3. Click Security
4. Click Edit
5. Select Domain Users
6. Check the Read & execute permission
   
7. Click OK
8. Click OK

You can configure AD SSO to import organizational units as Roles in Communifire when users login.

Get the distinguishedNames of the organizational units to import as roles

1. In Active Directory Users and Computers, right-click the organizational unit > Properties 
   
2. Click Attribute Editor 
   
3. Select distingushedName 
4. Click View 
   
   
5. Copy the value and save it somewhere for later
   
6. Repeat steps 1-5 for all the organizational units you want to import as roles

Update WindowsADSettings.config

In WindowsADSettings.config, find the following line:

<add key="RoleGroupsContainer" value=""/>

For value, enter a pipe-separated list of the distinguishedNames of the organizational units.

Example:

<add key="RoleGroupsContainer" value="OU=Developer,OU=CommunifireTeam,DC=adqa,DC=communifire,DC=com|OU=QA,OU=CommunifireTeam,DC=adqa,DC=communifire,DC=com"/>

Return to top

Open Communifire:

1. Once your site is up and running, you can manage Data Background sync process time interval in minutes.
2. Go to Control Panel > System > System Properties > Search for ActiveDirectorySyncManagerInterval and set ActiveDirectorySyncManagerInterval to your desired sync schedule. It's value is recommended between 120 - 1380 (in minutes).
   
   If 120 is set, the background process will run in every 2 hours.

You can initiate a manual sync in Sync Active Directory Data.

Return to top

Windows Internet Settings must be configured in order for a user to log in automatically based on server credentials. Follow the instructions below to configure automatic login.

1. Open the Control Panel.
2. Click Network and Internet.
   
3. Click Internet Options.
   
4. Click the Security tab.
   
5. Click Custom level...
   
6. Under User Authentication > Logon, select Automatic logon with current user name and password.
   
7. Click OK.

Return to top

This section covers adding a custom user in the domain controller, setting the user as the Communifire application pool identity in IIS, giving permissions to the user for several folders, updating properties for the media server folders, making web config changes, and updating modes.

Adding a custom user in domain controller

1. Under "Active Directory Users and Computers", right-click Users.
2. Select New > User.
3. In the window that opens, enter a first and last name.
4. For the logon name, enter "communifirewebfarm".
   
5. Click Next.
6. Enter a password.
7. Uncheck User must change password at login.
8. Check Password never expires.
   
9. Click Next.
10. Click Finish.
11. In the users list, right-click the communifirewebfarm user.
12. Click Properties.
13. Click the Member Of tab.
14. Ensure the user is a member of Domain Users.

Setting the communifirewebfarm user as the Communifire application pool identity in IIS

1. Right-click the application pool.
2. Click Advanced Settings....
3. Edit the Identity property.
4. Select Custom account.
5. Click Set.
   
6. In the next pane, enter the username in the format <domainname>\<username> .
7. Enter the password for the communifirewebfarm user.
   
8. Click OK.
   You will see the user added as the Identity for the Communifire application:
   

Purpose: A common user must be set as the pool identity in each Communifire application in IIS present on all the servers under webfarm. Let's say you have two servers: WebServer 1 and WebServer 2, and Communifire is deployed on both the servers. In this case, the Communifire application present on both the servers, WebSever 1 and WebSever 2, should have <domain/communifirewebfarm> user set as the application pool's identity in IIS.

Giving Read permission to the communifirewebfarm user at the root of the Communifire application

1. Right-click the root of the folder under which you have deployed your Communifire application.
2. Click Properties.
   
3. Click the Security tab.
4. Click Edit....
5. Click Add.
   
6. Click Advanced....
   
7. Enter search text to find the user.
8. Click Find Now.
9. Select the user under Search results.

1. Click OK.
2. Click OK.
3. Select the communifirewebfarm user under Group or user names.
4. Check the Read permission for the communifirewebfarm user:
   
5. Click OK.

Giving Read permission to Domain Users (<Domain>\ Domain Users) at the root of the Communifire application

1. Add a group Domain Users (format: <Domain>\ Domain Users) in the same way you added the communifirewebfarm user above.
    
2. Select Domain Users under Group or user names.
3. Check the Read permission for Domain Users.

Purpose: Since our application is Windows Authentication and the Anonymous authentication is off, the logged in users in Communifire applications will need Read access of various files, photos, script files etc. The application will request the GET request of all those files under the identity of Authenticated user and therefore the "<Domain>\Domain Users" group must have Read permissions over the entire application.

Giving Write permissions to the communifirewebfarm user for the four media server folders (Uploaded-CMS-Files, Uploaded-Files, Uploaded-Photos, and Uploaded-Videos)

1. Navigate to Assets\Uploaded-CMS-Files.
2. Right-click the folder.
3. Click Edit Permissions....
4. Click the Security tab.
5. Click Edit....
6. Select the communifirewebfarm user under Group or user names.
7. Check the Modify, Read & execute, List folder contents, Read, and Write permissions for the user:
   
8. Click OK.
9. Click OK.

Repeat steps 2-6 for the other three media server folders (Uploaded-Files, Uploaded-Photos and Uploaded-Videos), and check the Write permission.

Purpose: The Modify and Write permissions are necessary for the communifirewebfarm user because the application will write files over those four folders on various operations like Image Upload, File Upload, Video Upload, and will delete files, videos, and photos on various actions.

Giving Write permission to the communifirewebfarm user for Assets/CF-Utilities folder

Give the Write permission to the communifirewebfarm user for the Assets/CF-Utilities folder in the same way as the section above.

Purpose: The Assets/CF-Utilities folder needs the Modify permission because the Lucene dictionary search suggestion feature in Communifire needs to write over that folder.

Giving Read and Read and Execute permissions to bin\HiQPDF.dep file

1. Go to the bin folder of Communifire application.
2. Right-click the HiQPDF.dep file.
3. Click Properties.
   
4. Click the Security tab.
5. Click Edit....
6. Select the communifirewebfarm user under Group or user names.
7. Check the Read and Read and execute permissions for the communifirewebfarm user.
   
8. Click OK.
9. Click OK.

Purpose: The Read and Read and execute permissions are needed so that users can export content to PDF. The user running the HiQPdf HTML to PDF Converter should have execute permission for the HiQPdf.dep file. http://www.hiqpdf.com/FAQs.aspx

Setting the value of "authenticatedUserOverride" property to "UseWorkerProcessUser" for all the four media server folders (Uploaded-CMS-Files, Uploaded-Files, Uploaded-Photos and Uploaded-Videos)

1. Navigate to Assets\Uploaded-CMS-Files.
2. Open the Configuration Editor.
   
3. Click the Section dropdown.
4. Expand system.webServer.
5. Click serverRuntime.
   
6. Set the authenticatedUserOverride property to "UseWorkerProcessUser".
   

Repeat the steps above for the rest of the three media server folders (Uploaded-Files, Uploaded-Photos, and Uploaded-Videos).

Web config changes

Setting "Authentication" mode to "Windows":

<authentication mode="Windows" />
<authorization>
<deny users="?" />
</authorization>

Adding machine key:

      <machineKey 
        validationKey="9A18701973D521FD800088F461DF740E20698D264A7375094434C1B82012253B67324D96560518B769F2E50560C8804710EF606C7EEEE83C837C94DC4887E9C8" 
        decryptionKey="DFA2EED3F3C215F976F4E16FCFF5CB418FF4FEF4042C9711" 
      validation="SHA1" />

You need to generate your own machine key.

Seting RAMMFAR setting to true: 

<modules runAllManagedModulesForAllRequests="true">

Webfarm Troubleshooting

Issue: Login modal keeps on prompting despite adding the correct credentials.

Fix: https://stackoverflow.com/questions/18107044/401-unauthorized-error-web-api-mvc-windows-authentication/24333926#24333926

Issue: https://serverfault.com/questions/485006/why-cant-i-log-in-to-a-windows-protected-iis-7-5-directory-on-the-server

Fix: Disable the loopback check

Issue: Users are able to login via Active Directory using Chrome and Firefox, but not Internet Explorer.

Fix: Make sure that the SPN is configured properly for your ADFS service account. A service principal name (SPN) is a name that uniquely identifies an instance of a service. There should be an SPN registered for your ADFS service account. To verify this, refer to the following instructions:

1. On the domain controller server, click Start.
2. Click Run.
3. Enter adsiedit.msc to launch the ADSIEdit MMC console.
4. If necessary, connect to the site server's domain.
5. In the console pane, expand the site server's domain,
6. Expand DC=<server distinguished name>.
7. Expand CN=Users.
8. Right-click CN=<Service Account User>.
   The service account user is usually the administrator account.
9. On the context menu, click Properties.
10. In the CN=<Service Account User> Properties dialog box, review the servicePrincipalName value to ensure that a valid SPN has been created. If not, then add the value in this format: HTTP/FQDN.

Issue: Login modal coming on uploading files

Fix: Disable "Anonymous ;Authentication" if enabled.

Return to top

Issue: Images are missing on the site

Fix: In web.config, keep the value of the line below to false.

<modules runAllManagedModulesForAllRequests="false">

This fix is for virtual directories in the Assets folder (Uploaded Photos, Uploaded CMS files, Uploaded Videos, Uploaded Files).

Return to top