In this video from ITFreeTraining, I will be creating a relying party trust between
the ITFreeTraining Federation Server and the HighCostTraining Federation Server. This trust
is created on the ITFreeTraining side. I will now change to my computer running Windows
Server 2012 and get started.
The initial install of Active Directory Federation Services has already been completed on this
computer. In order for it to be used with other Federation servers it needs to be configured.
To do this, I will first open Server Manager from the quick launch bar and then from the
tools menu select the option for AD FS Management.
Once AD FS Management is open, I will expand down to “Relying Party Trusts”, right
click it and select the option for “Add Relying Party Trust”. This will start the
add relying trust wizard. Once I press start to get past the welcome screen, on the next
screen I need to determine how information about the relying party trust will be obtained.
The first option “Import data about the relying party published online or on a local
network” will attempt to contact another Federation Server using the network to obtain
the information that it requires in order to create the trust. This is the simplest
option but does required a network connection between the two servers.
The second option, “Import data about the relying party from a file” will obtain this
information from a file exported from the other Federation Server. You would use this
option if you do not have a direct connection between the two servers. For example, perhaps
the other Federation Server is on another company’s network and there is a firewall
between the two servers that prevents the connection.
The last option “Enter data about the relying party manually” allows the administrator
to enter details about the trust manually. This requires the administrator to know all
this information and generally, if possible, it is best to use one of the other options.
To understand where this data comes from, I will cancel out of the wizard and go back
to the admin tool. In the admin tool under service is a container called “Endpoints”.
Endpoints are used by Active Directory Federation Services to transfer information or provide
a particular service. For example, an endpoint may be used to accept a claim on the server.
If I scroll down to the bottom, notice the section Metadata. This is the End Point that
the other server contacts in order to obtain information about this server. Now that we
know where the server gets the information from, I will now run the Relying Party Trust
Wizard again.
Once I am past the welcome screen of the wizard, on the next screen I will enter in the fully
qualified domain name of the HighCostTraining Federation Server. In order for this server
to be resolved, on the ITFreeTraining network I have configured conditional forwarders pointing
to the HighCostTraining DNS servers.
Once I press next, the other server will be contacted. Notice that I will get an error
message. The server has attempted to open a secure connection using SSL; however, it
was not able to. In order for the secure connection to be created, the root CA for each network
needs to be exported and imported on the other network. Once this is done, this will allow
a secure connection to be made between the two networks to transfer the metadata.
To do this, I will exit out of these Windows and then move the mouse pointer up to the
top right hand side of the screen to open charms. Once charms is open, I will enter
in MMC. Once MMC is open, I will select the file menu and then select the option “Add/Remove
Snap in”. The snap-in that I am interested in is certificates which I will select from
the list and add it.
When I attempt to add the snap-in I will be presented with a dialog box asking which certificates
I want to manage. In this case, I will select computer account and press next. The next
and last screen will ask me which computer I want to manage certificates on. In this
case I will accept the default option of local computer and press finish.
Now that the certificate snap-in has been added, I can press o.k to close the window.
This network has an Enterprise CA installed on it. In order for the other network to trust
certificates issued from that Enterprise CA, I need to export its root certificate. This
certificate can be found under “Trusted Root Certification Authorities” and then
under “Certificates”.
Once the certificate container is opened I need to locate the root certificate and select
it. Once selected, I will right click and select “export” under all tasks to start
the export certificate wizard.
Once I am past the welcome screen, on the next screen I need to select which format
to export the certificate in. In this case I will accept the default option of DER and
move on to the next screen of the wizard.
On the next screen, I need to enter in a filename to export the certificate to. In this case
I will save the certificate to removable flash media that I have plugged into the computer.
Once the filename has been entered, I can complete the wizard and the certificate will
be exported.
Now that the certificate has been exported, I can remove the USB media from this computer.
I will now change to the server in the HighCostTraining domain that is running Active Directory Federation
Services.
I next need to install the certificate from ITFreeTraining on this server to allow a secure
connection to be established between the two servers. To do this, I will put the USB media
in this computer and open it in Windows Explorer.
You can see the exported certificate. To add it to the local certificate store, I will
double click it to open it and then press the button “Install Certificate” to start
the certificate import wizard. Once the wizard opens, I will select the option “Local Machine”
to store the certificate to be used with this computer.
Once I move onto the next screen, I need to select which certificate store to store the
certificate in. I will accept the default option which will automatically decide which
store to place the certificate in rather than manually selecting a store. Once this is done,
I will then complete the wizard.
As you can see, the certificate has been successfully imported; however, it will not work as expected.
To understand why, I will open MMC and add the certificates snap in and select computer
account when prompted. This will allow me to view all the certificates that are available
to this computer.
Before I look at the certificate that I just imported, I will first have a look at which
Root CA’s are currently stored in the local certificate store. To do this, I will expand
“Trusted Root Certification Authorities” and have a look inside the certificate container.
In here you can see the root certificate for HighCostTraining which I will select and export.
In the certificate export wizard, I will accept all the defaults when prompted and save the
certificate to the removable USB media.
Once the certificate has been exported, I will go back to the certificates snap-in.
Notice that in “Trusted Root Certification Authorities” there is no certificate for
ITFreeTraining even though I have imported one.
If I expand into “Intermediate Certification Authorities”, notice that the certificate
for ITFreeTraining can be found in here. If I open the certificate notice that there is
a message indicating that the certificate is not trusted. Windows has placed this certificate
in the wrong store. In order for the certificate to be trusted it needs to be added to the
“Trusted Root Certification Authorities”. To do this, I will exit out of the properties,
right click the certificate and select cut. I then open the “Trusted Root Certification
Authorities” and select the paste option. The certificate will then be moved to the
trusted root certificate store.
The server has the required certificate installed and the certificate from this network has
been exported to the USB removable drive. I will now change back to the other Windows
Server in ITFreeTraining.
On the ITFreeTraining Server, I will add the certificate for highCostTraining just like
I just did for the ITFreeTraining certificate on the HighCostTraining Server. To do this,
I will open Windows Explorer and select the HighCostTraining Certificate on the USB removable
media, right click it and select the option “Install Certificate” to start the certificate
import wizard.
Once the wizard has started, I will select the option for “Local Machine” and move
on to the next screen of the wizard. On the next screen, rather than let Windows decide
where the certificate should be stored, I will instead press the browse button and then
select “Trusted Root Certification Authorities” when prompted, to ensure that it is put into
the correct location. Once this is done, it is just a matter of completing the wizard
to import the certificate.
Now that the certificate has been imported, I will now close all the extra Windows that
I opened. Once done, I will select the tools menu and then select “AD FS Management”.
Now that the certificates have been installed, I can expand down to “Relying Party Trusts”,
right click it and select “Add Relying Party Trust” as I did previously. Once again,
I will enter in the name of the HighCostTraining Federation Server. This time when I press
next, the wizard will proceed without any problems.
On the next screen I will enter in a display name for the trust. This should be a descriptive
name that describes the trust.
On the next screen of the wizard I need to configure the default permissions for the
trust. By default the option “Permit all users to access this relying party” is selected.
This will allow any user to access the trust even if no permissions have been configured
for them.
In this case I will select the second option “Deny all users access to this relying party”.
This will deny all users access to the trust unless they have been specifically given access
to the trust. This gives better security but does mean the administrator will need to configure
who can use the trust.
Once I press next and move on to the next screen of the wizard, that screen will show
me all the information that will be used for the trust. You can see that there is a lot
of information. Some of it is obtained locally and some of it is obtained from the other
server.
Once I press next the trust will be created. On the last screen of the wizard is the tick
box “Open the Edit Claim Rules dialog for this relying party trust when the wizard closes”.
This will open the properties of the trust when I close the wizard. However, I will clear
this tick box so that I can show you how to do this step manually.
Once I close the wizard, the new trust will be displayed under “Relying Party Trust”.
If I right click the trust, I have the option to “Edit Claim Rules” which, when selected,
will open the properties of the rules of the trust.
The rules have 3 tabs. The first tab is “Issuance Transform Rules”. This tab allows data to
be transformed before being sent to the other party. For example, you could create a custom
rule that modifies the data retrieved from Active Directory and sends it to the other
party in a different format.
The tab “Delegation Authorization Rules” allows rules to be created that determine
if a requester is allowed to impersonate another user. In this case, I will create a new rule
on the tab “Issuance Authorization Rules”. To do this, I need to press the button “Add
Rules” to start the rule creation wizard.
To create the rule, I first need to select a template. Notice that in the list, there
are a lot of different templates to choose from. The rules created in here determine
who can use the trust. If there is no matching rule in here then the user will be denied
access. In this case, I will select the option “Send group Membership as a Claim”. This
will allow authentication to happen, based on group membership.
Once selected, I will move onto the next screen, where I need to configure some information
about the rules. First I will enter in a meaningful name for the claim. Once entered, I will next
configure a group for the claim by pressing the browse button. In this case I will use
the Domain Users groups. If you want to restrict access to particular users you will need to
create your own group and put the users whom you want to have access to the trust in that
group.
In this case, there are two domains in the forest, so two domain users groups have been
found. In this case, I will select the domain users group in the domain ITFreeTraining.
The next option that I will configure is under “Outgoing Claim Type”. You will notice
that there are a lot of options here. The option you choose here will determine what
the other side will see. In this particular case, I will select group; however, a different
option could be chosen if you wanted to change what the other party was seeing.
At the bottom, notice that you can enter in a value for the claim. In this case, I will
enter in “Web Application”. Essentially this will accept the group name “Domain
Users” and change it to the group name “Web Application”. As far as the other party
is aware, the group name is “Web Application”.
Once I press finish the rule will be created. If I exit out of “edit claim rules”, notice
that the new “Relying Party Trust” has been configured. Since the rule has been created,
it is ready to go. However, before this will work, the “Claim Provider Trust” must
be created on the other side, but I will leave that to an upcoming video.
I hope that you have enjoyed this video from ITFreeTraining and found it informative. I
hope to see you in future videos from this course and others. Till then, good bye and
thanks for watching.