Welcome to the ITFreeTraining video on creating a Relying Party trust. A relying party trust
is created on the side that creates a claim. This essentially determines what information
will be put into the claim for the other side to process. I will now change to my server
running Windows Server 2008 R2 and look at how to configure a Relying Party Trust.
In the previous videos, I have already installed and configured Active Directory Federation
Services. To create the Relying Party Trust, I will first open AD FS 2.0 Management from
the start menu under administrative tools.
To create the Relying Party Trust, expand “Trust Relationships” and then right click
on “Relying Party Trusts” and select the option “Add Relying Party Trust” to start
up the wizard.
Once I am past the welcome screen of the wizard, on the next screen, I need to select where
I am going to get the data that is going to be used to create the Relying Party Trust.
The first option creates a secure connection to the other server and reads the data directly
from the server. This is the simplest option, however it does require a direct connection
between the Federation Servers which may not always be possible.
The second option will import this data from a file. If a direct connection is not available,
this is the next best option. This requires the administrator to save the required information
and transport it to the other server. For example, they could e-mail the data or perhaps
store the data on a USB Flash Drive to transport between the servers.
The last option requires the administrator to enter in the data manually; but where does
this data come from? To understand that, I will cancel the wizard and then open the container
“Endpoints” under service.
EndPoints are used by Active Directory Federation Services to provide a way for another server
to access data or to be presented with claims. If I scroll down to the bottom, you can see
the section under metadata. If you want to export this data to another server, all you
need to do is open the XML file using your internet browser and then save the XML data
to a file.
Now that I know where the data comes from, I will run the Relying Party Wizard again
and go back to where I left off. I will next enter in the name of the other Federation
Server that I want to get the information from. This server is in another forest. So,
in order for it to be resolved, I have created a conditional forwarder on this network’s
DNS server.
When I press next, notice that I get an error message. The server was not able to create
a secure connection to the other server. The connection requires SSL which requires certificates;
so, I first need to install the required certificates in the local store on both servers so I can
have communication in both directions. To do this, I will run MMC from the start menu
and then select “Add/Remove Snap-in” from the file menu. Once open, I need to select
certificates from the list of available snap-ins.
The certificate snap-in is not available as a shortcut in the start menu; so, I have to
access it through MMC like this. Once selected, I next need to press the add button to add
the snap-in. Once added I need to select which certificates that I want to manage. In this
case I will select the option “Computer account” to manage the certificates that
are used by the server.
Once I press next, I will be asked which computer I want to manage. In this case, I will leave
it on the default option of local computer and press finish and close add remove snap-in.
Now that the certificate snap-in has been added, I can view the certificates for the
local machine. The certificate that I am interested in is found under “Trusted Root Certification
Authority” in the certificates container. In here, notice the certificate for the Enterprise
CA that is installed on this network. If I double click this certificate to open it,
this certificate is the Enterprise Root CA public certificate. Any computers that trust
this certificate will trust any certificate that has been issued from this CA. This is
the certificate that I need to export and import on the server in the other domain.
To export the certificate, I will select the details tab and then press the button at the
bottom of the screen “Copy to File”. This will start the certificate export wizard.
Once I am past the welcome screen, I need to select which format I want to export the
certificate to. The default format of DER will work fine; so I will leave it selected
and move on to the next screen of the wizard.
On the next screen of the wizard, I need to enter in a filename to save the certificate
to. In this case, I have a USB flash drive plugged into the server; so I will save it
to the flash drive. Once I press next, I will be at the end of the wizard and then press
finish to complete the wizard and the certificate will be exported.
Now that the certificate has been exported, I will change to the Active Directory Federation
Server in the HighCostTraining domain.
Just like before, I will run MMC from the start menu and then add the certificate snap-in
and select the options to manage the certificates for the computer account on the local computer.
This will allow me to view the certificates that the server will be using with Active
Directory Federation Services.
Before I import the certificate for ITFreeTraining, I will first export the HighCostTraining certificate.
Once this is done I will import the ITFreeTraining certificate. I next need to import the certificate
on both sides to ensure that I can make a connection in both directions.
If I expand down to “Trusted Root Certification Authorities”, in the certificates container
is the certificate for the HighCostTraining standalone CA. To export it, I just need to
right click on it, and select “Export” under “All Tasks” to start the export
wizard.
Once I am past the welcome screen, on the next screen I need to decide which file format
I want to use for the certificate. In this case the default format of DER will be fine,
so I will leave this selected and move on to the next screen in the wizard.
On the next screen, I will need to enter in a filename. I have already placed my USB flash
drive in the server, so I will save the certificate to that flash drive to be transported to the
server in the ITFreeTraining domain.
Once I press next, I will be at the end of the wizard and all I need to do is press finish
and the certificate will be exported.
Now that the certificate has been exported, the next step is to import the certificate
from ITFreeTraining. To do this, I will close these Windows and go back to the certificate
snap-in.
To import the certificate, I will right click on the white space and then select the option
“Import” under “All Tasks” to start the certificate import wizard.
Once I am past the welcome screen, on the next screen, I need to browse to the location
of the ITFreeTraining Certificate, which will be on the USB Flash drive. Once the certificate
has been selected, I will press open.
With the filename now in the wizard I will press next and be asked which store I want
to place the certificate in. You will notice that the certificate store that has been selected
is “Trusted Root Certification Authorities”. This store was selected because I started
the import from inside that container, so I can press next knowing that it will be stored
in the correct location.
Once when I press finish, the certificate will be imported. Now that the certificate
has been imported, I will now change back to my Federation Server running in the ITFreetraining
domain.
Now that I am back on the ITFreeTraining server, I need to import the certificate from HighCostTraining.
To do this, I will go back to the certificate snap-in, right click the white space and select
“Import” from under “All Tasks” to start the import wizard. Once I am past the
welcome screen, I will browse to my USB Flash drive and select the HighCostTraining certificate.
Once selected, I will press next and then move on to the next screen.
On this screen, I need to decide which store the certificate should be placed in. Since
I ran the import wizard from the container that I wanted to store the certificate from,
I do not need to change this and can press next to continue.
The wizard is now complete. When I press finish, the certificate will be imported. Now that
the certificate is imported, I can go back to the Relying Party Trust wizard.
Both servers have the root certificate from the other network stored in their local certificate
store, so should be able to communicate with each other. If I close the warning message
I got before and press next again, notice this time the wizard moves on to the next
screen without issue, so this time the servers were able to establish a secure connection
with each other using the certificates.
On the next screen, I will enter in a display name for the trust. This will help other administrators
identify what the trust is being used for.
Once I move onto the next screen, I will need to select what the default permissions will
be for the trust. By default, the option “Permit all users to access this relying party”
will be selected. This will allow all users to access the trust, even if they have not
been given access to the trust. To increase security I will select the second option “Deny
all users access to this relying party”. This option means that users will not have
access to the trust unless access to the trust has been granted to them by an administrator.
This offers greater security; however, also means that the administrator needs to configure
this before any user can use the trust.
The next screen of the wizard will show all the information that has been obtained to
create the trust. As you can see as I move through the tabs, there is a lot of information
that is needed to create a trust.
Once I press next, the trust will be created. On the final screen of the wizard is the tick
box “Open the Edit Claim Rules dialog for this relying party trust when the wizard closes”.
In this case, I will clear this option, so I can show you how to open this option manually.
If I now close the wizard, you can see the rule has been created. To edit it, all I need
to do is select it, right click and then select the option “Edit Claim Rules”. This will
open a window that will allow the 3 rules associated with that trust to be changed.
The first tab is “Issuance Transform Rules”. This tab allows rules to be transformed before
being sent to the other party. For example, you could create a custom rule that modifies
the data retrieved from Active Directory and sends it to the other party in a different
format.
The tab “Delegation Authorization Rules” allows rules to be created that determine
if a requester is allowed to impersonate another user. In this case, I will create a new rule
on the tab “Issuance Authorization Rules”. To do this, I need to press the button “Add
Rules” to start the rule creation wizard.
To create the rule, I first need to select a template. Notice that in the list, there
are a lot of different templates to choose from. The rules created in here determine
who can use the trust. In this case, I will select the option “Send group Membership
as a Claim”. This will allow authentication to happen, based on group membership.
Once selected, I will move onto the next screen. Here, I need to configure some information
about the rules. First I will enter in a meaningful name for the claim. Once entered, I will next
configure a group for the claim by pressing the browse button. In this case I will use
the Domain Users groups. If you want to restrict access to particular users you will need to
create your own group and put the users that you want to have access to the trust in that
group.
In this case there are two domains in the forest, so two domain users groups have been
found. In this case, I will select the domain users group in the domain ITFreeTraining.
The next option that I will configure is under “Outgoing Claim Type”. You will notice
that there are a lot of options here. The option you choose here will determine what
the other side will see. In this particular case, I will select group; however, a different
option could be chosen if you wanted to change what the other party was seeing.
At the bottom, notice that you can enter in a value for the claim. In this case, I will
enter in “Web Application”. Essentially this will accept the group name “Domain
Users” and change it to the group name “Web Application”. As far as the other party
is aware, the group name is “Web Application”.
Once I press finish, the rule will be created. If I exit out of “edit claim rules”, notice
that the new “Relying Party Trust” has been configured. Since the rule has been created,
it is ready to go. However, before this will work, the “Claim Provider Trust” must
be created on the other side, but I will leave that to an upcoming video.
Thanks for watching this video from ITFreeTraining. I hope to see you in upcoming videos from
us on this topic and others. Thanks, and see you next time.