To configure the web.oauth2.ext service:

1. In a text editor, open the appsettings.Production.json file for the web service.

   By default, this is:

   C:\Program Files\Intercede\MyID\web.oauth2.ext\appsettings.Production.json

   This file is the override configuration file for the appsettings.json file for the web service.

   You must edit the myid.adfs client section in this configuration file, and provide the required configuration settings.

2. Edit the following section in the appsettings.Production.json file:

   Copy

   "Clients":[
       {},
       {},
       {
           "ClientId":"myid.adfs",
           "ClientName":"MyID ADFS",
           "ClientSecrets":[
               {
                   "Value":"<secret>"
               }
           ],
           "RedirectUris":[
               "https://<auth service domain>/AdfsAuth/home/AdfsAuth"
           ],
           "Properties":
               {
                   "Skin":  "popover",
                   "EnableFido2LoginBasicAssurance":  false,
                   "EnableFido2LoginHighAssurance":  true
               }
           }
       }
   ]

   Important: When you have clients in the appsettings.json file and the appsettings.Production.json file, you must make sure the Production file does not overwrite the entries in the base file. In these settings files, entries in arrays are determined by their index; therefore if you have two client entries in the appsettings.json file before the myid.adfs entry, you must include two blank array entries {}, in the appsettings.Production.json file before you include the details for the myid.adfs client.

3. Set the following values:

   • <secret> – set this to the Base64-encoded SHA-256 hash of the secret you created; for example:

     "Value":"kv31VP5z/oKS0QMMaIfZ2UrhmQOdgAPpXV/vaF1cymk="

     See section 3.4.1, Generating a shared secret.

   • <auth service domain> – set this to the domain of the MyID ADFS Auth server; for example:

     "https://myserver.example.com/AdfsAuth/home/AdfsAuth"

   You can set the following Properties:

   • Skin – currently only popover is available as a skin option for the authentication GUI. The authentication web page shows a background image with a popover representing the authentication UI; this is suitable for large windows. If you are displaying the authentication page in a small popup window, you can omit this option.

   • EnableFido2LoginBasicAssurance – set this to true to allow authentication using FIDO basic assurance authenticators, which provide only single-factor authentication.

   • EnableFido2LoginHighAssurance – set this to true to allow authentication using FIDO high assurance authenticators, which provide multi-factor authentication.

     When using FIDO with web.oauth2, authentication using high and basic assurance is controlled using the logon mechanisms feature; as the web.oauth2.ext standalone authentication service does not use the MyID application server, this feature is not available, and you must specify the logon mechanisms using the above options.

     For more information about basic and high assurance FIDO authenticators, see the Supported authenticators section in the FIDO Authenticator Integration Guide.

   By default, EnableFido2LoginBasicAssurance is set to false, to prevent authentication with FIDO basic assurance authenticators, and EnableFido2LoginHighAssurance is set to true, to allow authentication with FIDO high assurance authenticators.

   For example:

   Copy

   "Clients":[
       {},
       {},
       {
           "ClientId":"myid.adfs",
           "ClientName":"MyID ADFS",
           "ClientSecrets":[
               {
                   "Value":"kv31VP5z/oKS0QMMaIfZ2UrhmQOdgAPpXV/vaF1cymk="
               }
           ],
           "RedirectUris":[
               "https://myserver.example.com/AdfsAuth/home/AdfsAuth"
           ],
           "Properties":
               {
                   "Skin":  "popover",
                   "EnableFido2LoginBasicAssurance":  false,
                   "EnableFido2LoginHighAssurance":  true
               }
           }
       }
   ]

4. Save the appsettings.Production.json file.

5. Recycle the web service app pool:

   1. On the MyID web server, in Internet Information Services (IIS) Manager, select Application Pools.
   2. Right-click the myid.web.oauth2.ext.pool application pool, then from the pop-up menu click Recycle.

   This ensures that the web service has picked up the changes to the configuration file.