Welcome to ITFreeTraining's next video in the Federation Services Course. In this video
I will look at installing and configuring Active Directory Federation Services in the
Resource Partner Organization.
In the previous videos, I installed and configured Active Directory Federation Services in the
account partner organization in the domain ITFreeTraining. In this video, I will install
and perform the basic configuration of Active Directory Federation Services for use in the
resource organization for the domain HighCostTraining. In this video, I will install a certificate
authority and Active Directory Federation Services on the same server to make things
simple. In the real world, you may not may not have a certificate infrastructure configured which
you can use with Active Directory Federation Services. If you do not, consider having a
look at our videos on how to deploy certificates in your organization. This video only looks
at a quick way to get Active Directory Federation Service going for use in a testing or lab
environment. Without further ado, I will now change to my Windows Server 2012 R2 computer
to have a look at how to install and configure Active Directory Federation Services.
First of all, I need to install the Active Directory Federation Services and Certificate
Authority role. To do this, I will open Server Manager and once Server Manager is open, select
the option "Add roles and features".
For the first few screens of the add roles and features wizard I will accept the defaults
since I am adding the roles to the local server.
Once I am on the Select Roles screen, I will select the role "Active Directory Certificate
Services". Once selected, I will press the "Add Features" button when prompted to add
the additional features the role requires.
Once the features have been added, I next need to select the role "Active Directory
Federation Services". Once selected, I will move on to the feature selection screen. In
this case, I do not need to add any additional features so I will press next and move on.
The next screen is the welcome screen for certificate services which tells you some
more information about the role. Once I move on to the next screen, I need to select which
components I want to install. In this case I only need basic certificate services, so
I will leave only the default option of "Certification Authority" selected and move on.
The next screen is the welcome screen for Federation Services, so I will press next
which will take me to the Confirm Installation Selections screen where I can press Install
to install the two roles. The install does take a minute or two to complete, so I will
pause the video and return shortly.
Once the install is complete, I next need to configure the two roles. Once I exit out
of the "Add roles and features" wizard, I will select the exclamation mark and then
select "Configure Active Directory Certificate Services on the destination server" to perform
the post configuration for the role.
The first screen will ask for a username and password to use with the post configuration
wizard. The user currently logged in will automatically be added which has enough access,
so I will leave it on this option and move on.
On the next screen, I need to choose which components of certificate services I want
to configure. This is quite simple, as I only installed the component "Certification Authority",
so I will select that component and move on.
On the next screen, I will select Standalone CA. If you are using a 3rd party CA, the process
will be the same for requesting the certificate. In this case, installing the CA on the same
server is just an easy way to obtain the required certificate for the install.
On the next screen, I will select Root CA. Once again this will work well for a test
environment, but in a production environment you would most likely have the root CA on
a different server for security reasons alone.
On the next few screens, I will accept all the default options until I get to the last
screen and then press configure to configure the role.
Configuration only takes a couple of seconds. Once complete, I will close out of here and
right click on the start icon to obtain the quick launch menu. From here, I will enter
in MMC. MMC is Microsoft Management Console which gives the administrator a customizable
interface to which they can add the admin tools they want to use. In this case, there
is no shortcut in Administrative Tools to access the local certificates on the computer,
so I need to access it through MMC.
From MMC, select the File option and then select the option "Add/Remove Snap-in". This
will show all the snap-ins available on this computer, from which I will select "Certificates"
and then press the button Add.
Once I press add, I need to select which certificates I want to show in the interface. In this case,
I want the certificates the server will use, so I will select the option "computer account"
and press next.
On the next screen I can choose a remote computer to view certificates on if I wanted to, but
in this case, I will leave it on the default option of "Local computer" and finish the
wizard.
If I expand down to Certificates under personal, I can see there is already one certificate
here. This certificate is created by default by Windows and cannot be used with Active
Directory Federation Services, so I need to create another one. To create the request,
I will right click on Certificates, select all tasks, advanced operations and then select
the option "Create Custom Request". This will launch the certificate enrollment wizard,
which allows a request to be created for a new certificate that I can use with my certificate
authority.
Once I go past the welcome screen, on the next screen I need to select which enrollment
policy I want to use. Enrollment is the process of obtaining a certificate automatically.
In this case, I will transfer the request file manually to the CA, so I will select
the option "Proceed without enrollment Policy" and move on to the next screen.
On the next screen, I need to select a template. For this example, I will select the option
"(No template) Legacy key". Active Directory Federation Services requires the private key
in the certificate in order to operate, and this option allows the private key to be exported
without any issues. The Request Format I will leave on the default option.
The next screen will show some information about the certificate that I am about to request,
but I want to make some changes before I complete the wizard. To do this, I will select the
down arrow next to Details and then press the Properties button.
The properties will open to the general tab. On the general tab, I will enter in a friendly
name and a description. Neither of these effect the operation of the certificate. However,
they do make it easier for other administrators to determine what the certificates are being
used for.
If I select the subject tab, there are some options that need to be configured here to
identify which server this certificate will be used with. If these options are not set
correctly, the certificate will not work with Active Directory Federation Services.
Under "Subject name" I will select "Common name" from the drop down box. Next I will
enter in the fully qualified domain name for the server. Once entered, I will press the
add button.
For this certificate, I will also enter in an "Alternative name". I can do this by selecting
DNS from the pull down menu and then entering the fully qualified domain name of the server.
Once entered, I will press the add button to add it.
The next option that I will configure is on the "Extensions" tab. On the extensions tab,
I will expand the section "Extended key Usage". Under this section I will add the
options "Server Authentication" and "Client Authentication".
Now that these two options have been added, I will select the next tab "Private key".
Under the section "Key options", I will expand it and, firstly, change the key size to 2048.
This is the minimum size for Active Directory Federation Services recommended by Microsoft.
Bigger keys offer better security but may hace compatibility problems so 2048 is
a good size to choose.
Next I need to make sure that the option "Make private key exportable" is ticked. If this
option is not ticked, Active Directory Federation Services will not be able to use the certificate.
Once the certificate request or certificate is created, this option cannot be changed
later on.
These are all the options that need to be configured, so I will press o.k. and then
move on to the next screen in the wizard. On this screen, I need to enter in the filename
to save the certificate request to. In this case, I will save the file to the desktop.
Once the filename is entered in, I can press finish to create the certificate request file,
which will be saved to the desktop.
The next step is to create the certificate that will be used with Active Directory Federation
Services. To do this, I will close MMC and then select "Certification Authority" from
under the tools menu.
Once certification authority has loaded, I will right click the server at the top, select
"All tasks" and then select "Submit new request". It is just a matter of browsing to the desktop
and selecting the certificate request file that I saved earlier. In a production environment,
this step may be performed by e-mailing the file to another administrator to create the
certificate or, possibly, uploading to a certificate authority using a web page. In this case,
once the file has been loaded, if I now select the container "Pending Requests", I can see
the certificate request. To issue the certificate all I need to do is right click the request
and, under "all tasks", select "Issue".
Once the certificate has been issued, I can see this new certificate under "Issued Certificates".
If I double left click the certificate to open the certificate, I can see information
about it. Even though the certificate is being stored in the certificate authority on this
server, I need to copy it to the local certificate store, so this Federation Services can access
it. To do this, I will select the "Details" tab and then press the button at the bottom
"Copy to File", to launch the certificate export wizard.
Once I am past the welcome screen, on the next screen, I need to select which format
to export the certificate in. In this case the default option will work fine, so I will
leave it on this option and move on.
On the next screen, I need to select a filename, so I will browse to the desktop and save the
certificate file there. Once the filename has been entered in, it is just a matter of
completing the wizard, and the certificate will be exported to the desktop.
Now that the certificate has been exported, I can close all these Windows and minimize
Server Manager to see the certificate on the desktop. If I now double click on the certificate,
this will open the certificate. But, more importantly, I can press the button "Install
Certificate" to start the certificate import wizard.
From the import wizard, I first need to make sure the option for store location is set
to "Local Machine". Once I press next, the wizard will next ask where I want to store
the certificate. Windows will look at the attributes of the certificate and attempt
to locate the best place to store it. In this case, I know the attributes were configured
correctly and thus Windows will store the certificate in the correct place, so I will
press next and press finish to complete the wizard. If you find the certificate is not
stored in the correct location, you may need to manually tell Windows where to store the certificate.
Now that the certificate has been imported to the local store, I can close these Windows
and go back to Server manager. The next step that needs to be completed is to configure
Active Directory Federation Services. To do this, I will select the exclamation mark and
select the option "Configure the federation service on this server".
On the welcome screen, I will leave it on the default option of "Create the first federation
server in a federation server farm", since this is the first Active Directory Federation
Server that will be configured on this network.
On the next screen, I need to configure which user will be used by the configuration wizard.
The user that I am currently logged in with has enough access, so I will leave it on the
default and move on.
On this screen, I need to select which certificate to use. Notice that when I select the pull
down arrow, the wizard has found the certificate that I created earlier. I will also enter
a display name for this server. Once done, I will move on to the next screen of the wizard.
On the next screen of the wizard, I need to select or create a managed service account
to run Active Directory Federation Services with. Notice that at the top, I have a warning
message and when I press "show more", I get a dialog boxing stating that a PowerShell
command needs to be run before a managed service account can be created. In order to run this
PowerShell command, I need to run the command on a server that has Active Directory admin
tools installed, which this server does not. For this reason, I will go back to server
manager, right click "all servers" and select "Add Servers". From add servers, I will press
"find now", locate a Domain Controller and then add it.
Once the domain controller has been added, if I now right click on the Domain Controller,
I can select the option for PowerShell and a PowerShell Window will open that is running
on that server. Once running, I will enter in the command that Server Manager asked me
to run. The command only takes a second or two to run. Once the command has completed,
I will now exit out of PowerShell and go back to the post configuration wizard for Active
Directory Federation Services.
The PowerShell command has been run, but I will need to press "back" and press "next"
again to refresh the wizard. Notice that I can now select the option "Create a Group
Managed Service Account" and enter in a service account name and, once entered, move on to
the next screen.
On the next screen, I need to select which database to use. There is no SQL server on
this network, so I will select the default option of using the Windows Internal Database
and move on.
The next screen will allow me to review the options that I have selected in the wizard.
Once I press next, on the next screen of the wizard, I will do a quick prerequisites check.
Notice that there is a warning message stating that the root key for the managed service
account has just been created. By default, this key will not be useable for 10 hours.
This is the root key I just created a moment ago using PowerShell. The reason behind this
is that it gives Active Directory time to replicate the key to other Domain Controllers.
What this essentially means is that the service that runs Active Directory Federation Services
may not work correctly for 10 hours.
To finish the configuration of Active Directory Federation Services, I can now press the button
configure. Active Directory Federation Services will now be configured which takes a few minutes
so I will pause the video and return shortly.
The configuration of Active Directory Federation Services is now complete. If I close the wizard
and go back to Server Manager, then select the tools menu and select "AD FS Management",
this will open the Active Directory Federation Management tool. Notice that the tool is fully
functional meaning Active Directory Federation Services is now ready to go, but that configuration
I will leave to our upcoming videos.
Well, I hope you have liked this video and I hope to see you in out other videos from
this course and other courses. Thanks for watching and see you next time.