Is it possible to implement captcha on ADFS sing-in form page ?

[Aslam Kader]

We have ADFS Proxy servers (Web Application Proxy servers) in our perimeter network and have MFA configured.

We also have configured a very strict ADFS Extranet Account Lockout policy (3 bad passwords, 1 hour lockout) but we see this as unsustainable for bruce force attack.   

We need to ensure at least one of the following solutions are available for ADFS 3.0 infrastructure.  Both of these are available through ADFS 2.0 infrastructure since the login pages are customisable.     

1. For Extranet authentication, perform MFA authentication first.  Then, if successful, perform the AD authentication.  Ideally, present one login page with AD and MFA login details instead of presenting two login pages for the users.
2. Allow the customising of the ADFS login page to add CAPTCHA authentication.  Microsoft adds CAPTCHA to its other sites so it shouldn’t be too difficult to integrate this to the ADFS 3.0 web forms, or at least allow us to use the reCaptcha API within the ADFS 3.0 infrastructure.

Either way, the work flow should be that, if the claim is being passed through a Web Application Proxy (ms-proxy), then present MFA page or CAPTCHA page before AD authentication page... or present them all in the first page but authenticate AD account only after MFA and/or CAPTCHA is authenticated successfully.

Can you please advise if these features are already available in ADFS 3.0?  Or do you know if they will become available in upcoming updates?

[#2]

We are currently experiencing frequent account lockouts from our ADFS servers.  We have tracked the offending authentication attemps to other countries.  We have tried working with MS portal support, but did not get any where.

We also have adjusted out ADFS Extranet lockout settings to no availe.

We too are wondering about:

1. MFA first for external authentication (having it second still allows multiple bad attempts)
2. Possible use of CAPTCHA (or something similar)
3. Setting some kind of geo-location limits to authentication

[#3]

If the MFA prompt was before the auth however, end users would be getting endless prompts on their devices. Not sure that is a alternative I would advocate.

[#4]

Setting up limits on geographical location can be done thorugh web application firewall like Incapsula.

You can check https://www.incapsula.com/

[#5]

Note that ADFS 2016 supports Azure MFA as a primary factor for authentication:

- Configure AD FS 2016 and Azure MFA https://docs.microsoft.com/en-ca/windows-server/identity/ad-fs/operations/configure-ad-fs-2016-and-a...

ADFS 2016 also support Windows Hello for Buisness as primary authentication too.

You can also use certificate based authentication as a primary factor for external authentication. This works since ADFS 2.0.