Install-SecureMFAEmailOtpProvider.ps1
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 |
<#
.SYNOPSIS Installs SecureMFA.com MFA Email OTP authentication provider for ADFS. .DESCRIPTION Deployment must be done from elevated PowerShell command window If you are using federation server farm that uses Windows Internal Database, you must start installation using the primary federation server of the farm as a MAIN node. Installation needs to be executed on ADFS farm server (not web application proxy servers). Dependencies: * System which executes a script must have Microsoft Framework 4.6.1 and above installed. * SecureMfaEmailOtpProvider.dll file must be present in script directory. * SecureMfaEmailOtpProvider.json configuration file must be present in script directory. Bellow is a sample of valid Json config file with minimal configuration required for installation: { "company": "MyCompany", "serialkey": "m00000000", "subscriptionid": "1000000000000000000000001", "sqlserver": "asqlaol1.adatum.labnet,1433", "sqldbname": "SecureMfaOTP", "sqlintegratedsecurity": "true", "sqluseraccount": "", "sqluserpassword": "", "smtp_server": "smtp.adatum.labnet", "smtp_mailfrom": "mfa.no.reply@adatum.labnet", "smtp_port": "25", "smtp_enablessl": "false", "smtp_username": "", "smtp_password": "", "smtp_remove_user_prefix": "false", "data_encryption": "false", "data_encryption_passphrase": "d9GhT=7=Ox8-+LaZ", "ui_customization": "false", "ui_login_text": "", "ui_login_failures": "0", "ui_lockout_minutes": "5", "ui_allowed_domains_for_otpcode": "", "totp_customization": "false", "totp_validity_seconds": "30", "auth_mode": "SQL", "verboselog": "false" } .PARAMETER NotMainNode NotMainNode parameter is required when you do installation on multiple ADFS nodes (not web application proxy servers). This needs to be executed on other adfs servers when installation of a provider is done on the MAIN(First) ADFS node. .NOTES Version: 2.0.0.1 Author: SecureMfa.com Creation Date: 28/07/2020 Purpose/Change: Changed to subscription licensing model. .EXAMPLE C:\PS> Install-SecureMfaEmailOtpProvider This command will install OTP authentication provider on the MAIN ADFS node. .EXAMPLE C:\PS> Install-SecureMfaEmailOtpProvider -NotMainNode This command will install OTP authentication provider on OTHER ADFS node(s). #> $dllpath = (Join-Path -Path $PSScriptRoot -ChildPath SecureMfaEmailOtpProvider.dll) $dllversion = [System.Diagnostics.FileVersionInfo]::GetVersionInfo("$dllpath").FileVersion $configpath = (Join-Path -Path $PSScriptRoot -ChildPath SecureMfaEmailOtpProvider.json) Write-Host "File: $dllpath" Write-Host "Version: $dllversion" Write-Host "Configuration: $configpath" #Spanish language $dllpath_es = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\es\SecureMfaEmailOtpProvider.resources.dll') #French language $dllpath_fr = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\fr\SecureMfaEmailOtpProvider.resources.dll') #German language $dllpath_de = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\de\SecureMfaEmailOtpProvider.resources.dll') #Chinese language $dllpath_zh = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\zh\SecureMfaEmailOtpProvider.resources.dll') #Portuguese language $dllpath_pt = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\pt\SecureMfaEmailOtpProvider.resources.dll') #Russian language $dllpath_ru = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\ru\SecureMfaEmailOtpProvider.resources.dll') #Italian language $dllpath_it = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\it\SecureMfaEmailOtpProvider.resources.dll') #Arabic language $dllpath_ar = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\ar\SecureMfaEmailOtpProvider.resources.dll') #Turkish language $dllpath_tr = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\tr\SecureMfaEmailOtpProvider.resources.dll') #Dutch language $dllpath_nl = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\nl\SecureMfaEmailOtpProvider.resources.dll') #Finnish language $dllpath_fi = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\fi\SecureMfaEmailOtpProvider.resources.dll') #Swedish language $dllpath_sv = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\sv\SecureMfaEmailOtpProvider.resources.dll') #Norwegian language $dllpath_no = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\no\SecureMfaEmailOtpProvider.resources.dll') #Polish language $dllpath_pl = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\pl\SecureMfaEmailOtpProvider.resources.dll') #Danish language $dllpath_da = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\da\SecureMfaEmailOtpProvider.resources.dll') #Lithuanian language $dllpath_lt = (Join-Path -Path $PSScriptRoot -ChildPath 'Languages\lt\SecureMfaEmailOtpProvider.resources.dll') #Create language file list array $languages_array = @(("Spanish", $dllpath_es),("French", $dllpath_fr),("German", $dllpath_de),("Chinese", $dllpath_zh),("Portuguese", $dllpath_pt),("Russian", $dllpath_ru),("Italian", $dllpath_it),("Arabic", $dllpath_ar),("Turkish", $dllpath_tr),("Dutch", $dllpath_nl),("Finnish", $dllpath_fi),("Swedish", $dllpath_sv),("Norwegian", $dllpath_no),("Polish", $dllpath_pl),("Danish", $dllpath_da),("Lithuanian", $dllpath_lt)) #Check if windows events source for application log exist, if not create one. if ([System.Diagnostics.EventLog]::SourceExists("Secure MFA Email OTP") -eq $False) {New-EventLog -LogName "Application" -Source "Secure MFA Email OTP"} #Load GAC Assembly Set-location $PSScriptRoot [System.Reflection.Assembly]::Load("System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a") $publish = New-Object System.EnterpriseServices.Internal.Publish Function Install-SecureMFAEmailOtpProvider { Param ( [Parameter(Mandatory=$false, ParameterSetName="Default")] [Switch]$NotMainNode ) #OTHER nodes install if ($NotMainNode) { try { $Error.Clear() if (!(Test-Path $dllpath -Type Leaf) ) { throw "The assembly $dllpath does not exist" } write-host "Installing SecureMfaEmailOtpProvider Language Files on the OTHER node" -ForegroundColor Green #Remove SecureMfaEmailOtpProvider Languages DLL files from GAC assembly $languages_array | % { Write-Host "Removing language" $_[0] ":" $_[1] -ForegroundColor yellow; $publish.GacRemove($_[1]) } #Add SecureMfaEmailOtpProvider Languages DLL files to GAC assembly $languages_array | % { Write-Host "Adding language" $_[0] ":" $_[1] -ForegroundColor Green; $publish.GacInstall($_[1]) } write-host "Installing SecureMfaEmailOtpProvider on the OTHER node" -ForegroundColor Cyan #Remove SecureMfaEmailOtpProvider DLL from GAC assembly Write-Host "Removing SecureMfaEmailOtpProvider $dllpath" -ForegroundColor yellow; $publish.GacRemove($dllpath) #Add SecureMfaEmailOtpProvider DLL to GAC assembly Write-Host "Adding SecureMfaEmailOtpProvider $dllpath" -ForegroundColor Green; $publish.GacInstall($dllpath) #Restart ADFS service write-host "Restarting adfssrv service." -ForegroundColor Green Stop-Service adfssrv Start-Service adfssrv } catch { Write-Host "$($MyInvocation.InvocationName): $_" -ForegroundColor red } } #MAIN nodes install else { try { $Error.Clear() if (!(Test-Path $dllpath -Type Leaf) ) { throw "The assembly $dllpath does not exist" } write-host "Installing SecureMfaEmailOtpProvider on the MAIN node using configuration $configpath" -ForegroundColor Cyan #Remove additional authentication providers from ADFS global policy and unregister SecureMfaEmailOtpProvider write-host "Removing additional authentication providers from ADFS global policy and unregistering SecureMfaEmailOtpProvider." -ForegroundColor Green Set-AdfsGlobalAuthenticationPolicy -AdditionalAuthenticationProvider "" unregister-AdfsAuthenticationProvider -Name �SecureMfaEmailOtpProvider� -Confirm:$false #Restart ADFS service write-host "Restarting adfssrv service." -ForegroundColor Green Stop-Service adfssrv Start-Service adfssrv write-host "Installing SecureMfaEmailOtpProvider Language Files..." -ForegroundColor Green #Remove SecureMfaEmailOtpProvider Languages DLL files from GAC assembly $languages_array | % { Write-Host "Removing language" $_[0] ":" $_[1] -ForegroundColor yellow; $publish.GacRemove($_[1]) } #Add SecureMfaEmailOtpProvider Languages DLL files to GAC assembly $languages_array | % { Write-Host "Adding language" $_[0] ":" $_[1] -ForegroundColor Green; $publish.GacInstall($_[1]) } write-host "Installing SecureMfaEmailOtpProvider..." -ForegroundColor Green #Remove SecureMfaEmailOtpProvider DLL from GAC assembly Write-Host "Removing SecureMfaEmailOtpProvider $dllpath" -ForegroundColor yellow; $publish.GacRemove($dllpath) #Add SecureMfaEmailOtpProvider DLL to GAC assembly Write-Host "Adding SecureMfaEmailOtpProvider $dllpath" -ForegroundColor Green; $publish.GacInstall($dllpath) #Register SecureMfaEmailOtpProvider addapter $typeName = �SecureMfaEmailOtpProvider.AuthenticationAdapter, SecureMfaEmailOtpProvider, Version=$dllversion, Culture=neutral, PublicKeyToken=1ecd877c866018d2, processorArchitecture=MSIL� Register-AdfsAuthenticationProvider -TypeName $typeName -Name �SecureMfaEmailOtpProvider� -ConfigurationFilePath $configpath #Restart ADFS service write-host "Restarting adfssrv service." -ForegroundColor Green Stop-Service adfssrv Start-Service adfssrv #Add SecureMfaEmailOtpProvider as additional authentication provider in ADFS write-host "Setting SecureMfaEmailOtpProvider as additional authentication provider in global authentication policy." -ForegroundColor Green Set-AdfsGlobalAuthenticationPolicy -AdditionalAuthenticationProvider "SecureMfaEmailOtpProvider" } catch { Write-Host "$($MyInvocation.InvocationName): $_" -ForegroundColor red } } #List all authentication providers Get-AdfsAuthenticationProvider | select name } |