Welcome to the ITFreeTraining video on installing Active Directory Federation Services on Windows
Server 2008 R2. In a previous video, I installed and configured an Enterprise CA to provide
a certificate for this server. Federation Services needs a certificate in order to be
installed, so you will need to have a certificate infrastructure on your network in order to
perform the install. I will now change to my Windows Server 2008 R2 server, in order
to perform the install.
The version of Active Directory Federation Services that I will install is version 2.
The version that comes in Windows Server 2008 R2 is version 1, so I will need to download
the newer version. To do this, I will open Internet Explorer from the start menu. From
Internet Explorer, I will open google and then search for ADFS 2.0 RTW. RTW stands for
release to web.
You can see that the first result is the download for ADFS. If you have trouble finding this
link, I have added it to the reference section in the description of this video. Once I press
continue, I will be asked if I want to register with Microsoft. If you register you will be
kept up to date with new releases from Microsoft. In this case I will leave it on the default
option of “No, I do not want to register. Take Me to the download”.
On the next screen I need to select which download I want. In this case, I will select
the 64bit version for Windows Server 2008 R2. Once selected, I will press the continue
button to start the download.
I will save the download to the desktop. It is important to download and install this
update. Otherwise, if you install the version found in server manager that was shipped with
the operating system, this will install version 1.0.
Once the download has completed, I will close internet explorer and then run it from the
desktop. Once the install starts, I will move past the welcome screen and then, when asked,
I will accept the license agreement and move on.
On the next screen, I need to decide which component of Federation Services I am installing.
In this case, I will leave it on the default option of “Federation server”. The second
option “Federation server proxy” you would most likely install on your DMZ, to allow
access to the Federation Server from the internet.
On the next screen, I will be informed which additional software is required for the install.
There is no need for the administrator to install this software as the install will
attempt to install itself, if it is not present already.
Once I press next, the install will start. The process takes a few minutes to complete,
so I will pause the video and return shortly.
Once the install has completed, I will untick the tick box “Start the AD FS Management
snap-in when the wizard closes”. This option would open the admin tool when I press finish
but I would rather show you how to do this manually. To do this, I will press finish
and then from the start menu select “AD FS 2.0 Management” under “Administrative Tools”.
Once the tool has opened, I will select the option “AD FS 2.0 Federation Server Configuration
Wizard” on the home page. This will launch the wizard that will allow me to configure
the server.
On the welcome screen of the wizard, I need to select the type of install I want to perform.
The first option “Create a new Federation Server” will need to be selected if you
do not have any Federation Servers on the network already. The second option will add
the server to an existing farm, if one exists. In this case, I do not have an existing Federation
Server farm, so I will leave it on the default option and move on to the next screen of the
wizard.
On the next screen, I need to decide if I want to create a new federation server farm
or perform a stand-alone install. The default option “New federation server farm” will
create a new farm, which I can add additional servers to later on, if I want to. The second
option “Stand-alone Federation server” will create a single Federation server. Both
options provide the same set of features. The stand-alone option is recommended for
smaller or testing environments. If you are not sure, select the first option “New federation
Server farm”, as this gives you the most options later on.
Once I move onto the next screen, I need to decide which certificate should be used. There
is a certificate on this server already, but notice that it is grayed out, as it is not
compatible. I need to obtain a certificate that is compatible with Active Directory Federation
Services. To do this, I will open the start menu and then enter in MMC in the run box.
This will open Microsoft Management Console, which will allow me to add the certificate
snap-in, which is not available in the start menu as a short cut.
To add the snap-in, I will select file and then select “Add/Remove Snap-in”. From
the list, I need to select certificates and then press add. This will bring up another
Window which will allow me to decide which certificates that I want to manage. In this
case, I will select the option “Computer Account”, so that I can view the certificates
that are used by the local computer.
On the next screen, I need to decide which computer I want to view the certificates on.
In this case I will leave it on the default option of the local computer and then press
finish to complete the wizard.
Now that the options have been configured, I will press o.k. and the snap-in will be
added and ready to view the certificates on the local computer.
By default, certificates will be shown in the logical certificate stores view. I need
to view certificates by their purpose. To change the view, select the view menu and
then select options. From the view options, I will next tick the option “Certificate
purpose” and press o.k.
You can now see the view has changed, showing the certificates in a container based on their
purpose. The certificate container that I am interested in is “Server Authentication”.
The next step is to request a certificate to go into this container. To do this, I will
right click the container “Server Authentication” and then under “All Tasks” I will select
the option “Request New Certificate”.
Once I am past the welcome screen, on the next screen, I need to select how I will use
auto enrollment to obtain a certificate. Auto enrollment is when the server contacts the
Enterprise CA and uses a secure channel to request and transfer the certificate to the
local computer.
In this case, I will leave it on the default option of “Active Directory Enrollment Policy”.
This is the default policy in Windows which will attempt to contact an Enterprise CA in
order to obtain a certificate.
Once I press next, I need to select which template I want to use to generate the certificate.
In the previous video, I created a certificate template to use with Active Directory Federation
Services. It is listed here, so I will select it and then press the enroll button.
The enrollment, as you can see, does not take too long to complete. Now that it is complete,
I can close these Windows, go back to the configuration wizard, and move onto the next
screen, since I now have a valid certificate to use.
On the next screen, the configuration wizard will detect that an AD FS database already
exists. On this server I installed AD FS version 1, so this database has been detected. Since
I do not require that data, I will tick the option “Delete database” to remove the
existing data and then move onto the next screen of the wizard.
On this screen, I need to select a service account to run Active Directory Federation
Services with. I have already created a domain user in the domain to use as the service account.
To select that account all I need to do is press browse and type in the name of the account.
The user account has been added; however, since it is only a domain user, it will not
have enough access to run Active Directory Federation Services and it needs to be added
to the local administrators group. To do this, I will open the start menu and then select
“Computer Management” under “Administrative Tools”.
Once open, I will expand down to “Groups” under “Local Users and Groups” and then
right click on administrators and select the option “Add to Group”. To add the service
account, I will press the add button and then enter in the name of the service account.
You will notice that the service account has now been added to the administrators group.
Once I go back to the wizard, all I need to do is enter in the password and move onto
the next screen.
The next screen shows a summary of the configuration. Once I press next, the server will be configured
for use with Active Directory Federation Services. The process takes a few minutes to complete,
so I will pause the video and return shortly.
Notice that one of the steps has completed with a warning. If I select the warning, you
see that this refers to the SPN of the service account not being able to be configured. This
was configured when I created the user account. Setup will not change it if it has already
been configured. If you need to change it, you can open the properties of the user account
and change it, there.
I will now close the wizard and you can see that the configuration of the server is now
complete. In later videos I will look at how to start using Active Directory Federation
Services, now that it has been installed and configured. Until then, I would like to thank
you for watching and I hope to see you in those videos.