Welcome to the next ITFreeTraining video on setting up Active Directory Federation Services.
In this video, I will look at setting up Active Directory Federation Services for HighCostTraining.
To make the install simple, I will also install a stand-alone certificate authority on the
same server. To get started, I will now change to my server running Windows Server 2012.
To install the required roles, I will first open Server Manager. Once server manager has
opened, I will next select the option “Add roles and features” to launch the wizard.
Since I will be adding the roles to the local server, for the first few screens I will accept
the default options.
On the roles selection screen, I will select the role Active Directory Certificate Services.
Once selected, a prompt will appear asking for additional features to be installed. When
this appears, I will press the button “Add Features” to add these features.
The next role that I will add is “Active Directory Federation Services”. Once this
role is selected, I will once again be prompted for additional features, which I will add.
Now that the required roles have been added, I will move onto the next screen, which will
ask which features I want to add. In this case, no additional features are required
other than those I was prompted for, so I will move on to the next screen of the wizard.
The next screen is the welcome screen for certificate services. Once I am past the welcome
screen, the next screen will ask which components of certificate services I require. In this
case, the default component of “Certification Authority” is enough to create certificates
for Active Directory Federation Services, so I will leave this selected and move on.
The next screen of the wizard is the welcome screen for Active Directory Federation Services.
Once I am past this screen, the next screen will ask which components of Active Directory
Federation Services I require. In this case, the default component of “Federation Service”
is enough, so I will leave this selected and move on.
The next screen is the IIS welcome screen. Active Directory Federation Services requires
IIS. Once I am past the welcome screen, I will be able to select which components of
IIS I want to install. In this case I will accept the defaults and move on to the end
of the wizard.
Once I press install, the required components will be installed. The process does take a
few minutes to complete, so I will pause the video and return shortly.
Now that the roles have been installed, the next step is to configure the roles. The first
role that I will configure is Active Directory Certificate Services. To do this, I will click
the exclamation mark and then select the option below this, “Configure Active Directory
Services on the destination server” to launch the configuration wizard.
On the welcome screen, the current user will be added to the wizard. In this case, I am
logged in as a domain administrator, so this is enough access to perform the configuration.
If the current user does not have enough access, a different user with more access can be entered
in on this screen.
Once I move onto the next screen, I need to select which components I want to configure.
In this case, I have only installed the one component so I will select the component “Certification
Authority” and move on. On the next screen I need to select which
type of CA I want to install. In this case I will select the second option “Standalone
CA”. A standalone CA does not require the server to be a member of the domain and thus
is not required to be online, other than to issue certificates.
Once I move on to the next screen, I will next need to select the type of CA that I
want to install. In this case, I will leave it on the default option of “Root CA”.
A root CA forms the top of a certificate authority and does not require any other CA’s to operate.
In this case, this demonstration is designed to get Active Directory Federation Services
working using the minimal amount of effort, so I will install a Root CA to provide a certificate
for the install. This is fine for a test environment. If you are going to use Active Directory Federation
Services, it is recommend that you use an existing CA infrastructure. If you do not
have an existing CA infrastructure and need to deploy one, do your research first, as
installing and configuring a CA infrastructure requires a lot of work and planning.
With “Root CA” selected, I will go through the rest of the wizard accepting all the defaults.
Once again, you should do your research and configure these settings for your company’s
needs, but this is enough to get a basic non-production Active Directory Federation Services install
up and going.
Once I am at the confirmation screen, I will press configure and the server will be configured
as a Root CA. The process does not take too long to complete. The next step is to create
a certificate that can be used with Active Directory Federation Services. To do this,
I need to create a certificate request.
To create a new certificate request, I will close this wizard and move the mouse to the
top right of the screen to open charms. Once open, I will enter in MMC in the search box
and then select the icon for MMC when it appears.
Once MMC opens, I next need to select “Add/Remove Snap-in” from the file menu. From the list
of available snap-ins, I need to select certificates and then press the add button. MMC will then
ask which certificate store you want to view. In this case, I need to select the option
“Computer account” to view the certificates that are relevant to this computer only.
On the next screen I need to select which computer I want to access, in this case, I
will accept the default option for the local computer, complete the wizard and then exit
“add remove snap-ins”.
Now that the certificate snap-in is opened, I next will expand down to the Personal container,
right click it and select “Create Custom Request” under all tasks and then under
Advanced Operations, to start the certificate enrollment wizard.
Once I am past the welcome screen, on the next screen, I need to select the option “Proceed
without enrollment policy”, since I will not use an automated process to supply the
certificate, like an Enterprise CA.
On the next screen, I need to select the template for the certificate request and the format
the file will be in. For the template, I need to select “(No Template) Legacy Key”.
When the certificate is created, Active Directory Federation Services requires the private key.
This template makes sure that the private key is able to be exported. For the request
format I will leave on the default option of PKCS.
Once I move onto the next screen, I need to make some changes to the certificate request.
To do this I will expand the detail section and then press the button properties.
On the general tab, I will enter in a friendly name and a description. What you enter in
here does not affect the certificate or how it is used; however, putting in a good friendly
name and description helps identify the certificate and what it is created for.
Next I will select the subject tab. Two values need to be added here, otherwise the certificate
will not be usable. First, under subject the type needs to be set to common name. The value
needs to be configured to the fully qualified domain name of the server.
The next value will be the same, so I will copy this value and then under alternative
name, configure the type to DNS and paste the value in.
Now that the values have been configured to the fully qualified domain name for this sever,
I will press the add button to add them.
Now that the values have been added, I will next select the extensions tab. This will
allow me to define how this certificate can be used. In this case I will expand “Extended
Key Usage” and add the options for “Server Authentication” and “Client Authentication”.
These are required for Active Directory Federation Services.
Next I will select the “Private Key” tab. Active Directory Federation Services requires
access to the private key in order to operate. To configure the private key, I will expand
“Key options” and then set the “Key size” to 2048. You can use a smaller key
size; however, Microsoft recommends a key length of at least 2048. Next I need to tick
the tickbox “Make private key exportable”.
These are all the properties that need to be configured, I will now press o.k. to go
back to the wizard and then move onto the next screen of the wizard.
On the next screen I need to enter in the filename I want to save the certificate request
to. In this case, I will browse to the desktop and save the request file there. The request
file extension is REQ, but notice that if I do not enter this in the wizard, it will
not add it for me.
Once the filename has been entered in, I will press finish and the request file will be
created. Now that the request file has been created, the next step is to use it to create
a certificate. To do this, I will select the option “Certification Authority” under
the tools menu.
To create the certificate, a new request needs to be submitted to the certificate authority.
To do this, right click the certificate authority, and select “Submit new request” found
under all tasks. Once selected, it is just a matter of browsing to the location of the
request file, which in this case has been saved to the desktop.
Notice that because the file was not saved with the REQ extension, it has not appeared.
So, I need to select the option “All Files” from the pull down, and then select the request
file when it appears.
Once I press open, the request for a new certificate will be submitted. If I now expand down into
pending requests, you can see the request for the certificate. To issue the certificate,
all I need to do is right click the request and under “All Tasks” select the option
“Issue”.
Once the certificate has been issued, if I open the container “Issued Certificates”,
you can see the certificate that has been issued for Active Directory Federation Services.
If I double click the certificate, I can see the details of the certificate.
To export the certificate for use with Active Directory Federation Services, I need to select
the details tab and then press the button copy to file. This will launch the export
wizard.
Once I am past the welcome screen, on the next screen, I need to decide which format
to use for the certificate. In this case, the default format of DER will work fine.
Once I press next, I will need enter in a filename to export the certificate to. In
this case, I will save the certificate to the desktop. Once I have entered in a filename,
I can complete the wizard and the certificate will be exported to the desktop.
The certificate stills needs to be imported to the local computer before it can be used,
but I will leave that to later on to show what happens if a certificate cannot be found
during the configuration of Active Directory Federation Services.
To start the configuration of Active Directory Federation Services, I will close all these
Windows, click the exclamation mark, and select the option “Run the AD FS Management Snap-in”.
Once open, I need to select the option “AD FS Federation Server Configuration Wizard”
to start the configuration of the server.
On the first screen of the wizard, I will leave it on the default option of “Create
a new Federation Service”. In this case, no Federation servers exist on this network.
If you already had a Federation Server, you may want to add this server to the existing
farm so that both Federation servers work together to provide redundancy.
On the next screen, I have two options. The option “Stand-alone federation server”
will install the Federation Server as a single server. This is recommend for testing or for
a small production environment. If you choose this option, you will not be able to add additional
servers to form a server farm later on.
The top option “New federation server farm” will create a new farm for the Federation
server, which will allow additional servers to be added at a later date. Both options
provide the same features, so if you are not sure I would select the top option and create
a farm rather than creating a single stand-alone server.
When I move onto the next screen, the wizard has found a certificate but is not able to
use it. This is the certificate for the CA rather than the certificate that was created
earlier. Before I can continue in the wizard, I need to install the certificate that I created
earlier. To do this, I will open Windows Explorer and double click on the certificate that I
saved to the desktop.
Once the certificate is open I need to press the button “Install Certificate”. This
will start the certificate import wizard. On the welcome screen, I need to select the
option “Local Machine”, to install the certificate in the store used by the local
computer.
On the next screen, I need to decide which certificate store to put the certificate in.
The default will let Windows decide which store to place the certificate in. In this
case I will leave it on the default option of “Automatically select the certificate
store based on the type of certificate” and Windows will attempt to choose the best
location to store the certificate in.
Once I press finish the certificate will be imported. If I now close these Windows and
go back to the configuration wizard, to use the certificate I will need to press previous
and then press next to refresh the view. You can now see that the wizard has found the
certificate. Once I press next in the wizard, the next
screen will ask which service account will be used with this install of Active Directory
Federation Services.
I have already created a service account in Active Directory. This service account was
created with domain user rights. In order for this service account to be used with Active
Directory Federation Services on this server, it needs to be added to the local administrators
group on this server. In order to do this, I will select the tools menu and then select
the option “Computer Management”.
Once computer management has opened, I will expand “Local Users and groups” and then
select the container Groups. I will then right click on the “Administrators” group and
select the option “Add to group”. This will open the properties for the local administrators
group. Once open, it is just a matter of pressing add and entering in the name of the service
account I created.
I can now close out of these Windows and go back to the configuration wizard. It is just
a matter of pressing the browse button and entering in the name of the service account.
Once this is done I need to enter in the password for the service account, and move onto the
next screen.
The next screen of the wizard will show a summary of all the options that have been
selected. Once I press next, the configuration of the Active Directory Federation Service
will start. This takes a minute or two to complete, so I will pause the video and return
shortly.
The configuration of the server is now complete. Notice that I have a warning message. If I
click on this message it indicates that the SPN for the user account could not be configured.
In this case, the SPN has been configured correctly. If you find that Active Directory
Federation Service will not start up, check that the SPN on the service account is configured
correctly in the properties of the user account.
If I now close the wizard, notice that the admin tool for Active Directory Federation
Services is now working. The next step is to configure it to work with other Active
Directory Federation Services, but that I will leave to a later video.
Thanks for watching this video from ITFreeTraining. I hope to see you in other videos from us
from this course and others. Until then, thanks for watching.