Welcome to the ITFreeTraining video on setting up Active Directory Federation Services in
the HighCostTraining domain. This video will look at installing and configuring Active
Directory Federation Services, or AD FS, on Windows Server 2008 R2, and also installing
a stand-alone CA on the same server to issue it a certificate. In a previous video, I configured
AD FS in the ITFreeTraining domain. Once *this* server is configured, in later videos I will
be able to establish a trust between the two servers. I will now change to my Server running
Windows Server 2008 R2 to install and configure a standalone CA and AD FS.
To start the install, I will first open Server Manager from the quick launch bar. Once open,
I need to select Roles from the left hand side and then select the option “Add Roles”
on the right hand side to start the add roles wizard.
Once I am past the welcome screen, I need to select which roles that I want to install
on this server. In this case I will select only “Active Directory Certificate Services”.
The role “Active Directory Federation Services” is also available; however, this will install
version 1.0. Rather than install this version, I will instead download version 2.0 and install
this version later in the video.
Once I press next, I will be presented with the welcome screen for certificate services.
Once I press next again, I need to select which components of certificate services that
I want to install. In this case the default component of “Certification Authority”
is all I need, so I will leave this selected and move on.
On the next screen, I need to decide which certificate authority I want to install. In
this case I will select the option standalone and move on. On the next screen, I need to
select if the certificate authority will be a root CA or subordinate CA. In this case
I will select Root CA. So effectively I am installing a certificate authority that can
issue certificates and does not require any other infrastructure to work. In a testing
environment, this is an easy solution to get AD FS up and running. However, on a production
network, you are most likely going to deploy a more sophisticated solution which will provide
additional security. This set up has the private keys for root CA on a production server which
is not recommended. See our Certificate course for more information about this.
On the next few screens, I will accept all the defaults. In a production environment
you will want to perform your own research to work out the best settings for your network.
On the last screen, I need to press install and the role will be installed. The process
takes a few minutes to complete, so I will pause the video and return shortly.
Now that a certificate authority has been installed, the next step is to request a certificate
from it to be used on this server with Active Directory Federation Services. To do this,
I will close Server Manager and then press the start menu and enter in MMC in the run
box. Once MMC is open I will need to add the certificate snap-in. To do this, I will select
“Add/Remove Snap-in” from the file menu.
Once I add the snap-in, I will be asked which certificates that I want to manage. In this
case I will select “Computer account” so I can manage the certificates that are
used for the computer. Once I press next, I will accept the default option local computer
so that I will view the certificates that are on the local computer. Once this is done,
I can close the Window and go back to MMC.
The next step is to request a certificate for use with Active Directory Federation Services.
To do this, I will expand down to personal, right click it and then under “All Tasks”
select “Advanced Operations” and then select the option “Create Custom Request”.
This will create a request file that I can use with the stand-alone certificate authority.
Once I select the option, this will open the “Certificate Enrollment” wizard. Once
I move past the welcome screen, on the next screen I need to select how I will request
the certificate. A standalone CA does not support enrollment, so I will need to select
the option “Process without enrollment policy”. This option will create a request file that
can be used with the standalone CA to obtain a certificate.
On the next screen, I need to set some options for the certificate. The first option I will
select under template is “(No template) Legacy key”. AD FS requires access to the
private key. Selecting this option allows the certificate to contain the private key.
The request format I will leave on the default of PKCS. With these options selected, I will
press next and move on.
On the next screen, there does not appear to be any options to configure. However, notice
that when I select details, I get a properties button. Once I press the properties button,
I need to enter in additional details for the certificate request.
On the general tab, I will enter in a friendly name for the certificate and a description
for the certificate. This does not affect how the certificate can be used, but does
make it easier for an administrator to identify what the certificate is being used for.
Next I will select the subject tab. There are two settings that need to be configured
on this screen in order for the certificate to be used with Active Directory Certificate
Services. Under subject name, this needs to be set to common name, and the value needs
to be set to the fully qualified domain name of the server. Once this is done, I next need
to press the add button.
Once this is done, the alternative name also needs to be set. For the type I will select
DNS from the pull down menu and then, once again, for the value enter in the fully qualified
domain name for the server and press add.
Those are all the settings that need to be configured on the subject tab. Next I need
to select the “Extensions tab”. On the extension tab, I need to expand the section
under “Extended Key Usage (application polices)”. This determines what the certificate can be
used for. For this I need to add “Server Authentication” and “Client Authentication”.
Once this is done, I can configure the options that are found under the “Private Key”
tab.
The options that I need to configure are found in the “Key options” section. Once I expand
this section, the first option that I will change is the key size. This I will set to
2048. 1024 will work as well, but Microsoft recommends at least 2048 for good security.
Next I need to tick the tick box “Make private key exportable”. Active Directory Federation
Services requires access to the private key, without this the certificate cannot be used.
All the properties have been configured, so I will now press o.k. and then move on to
the next screen of the wizard.
On this screen, I need to configure where I want to save the request. In this case,
I will press the browse button and save the request to the desktop. Since the CA is on
the same server, I do not need to save the request to a network location or removable
media to transport the request to the CA.
Once the filename has been entered, I can press finish and complete the wizard. Now
that the request has been saved, the next step is to issue the certificate. To do this,
I will open the start menu and then select “Certification Authority” found under
Administrative Tools.
Once Certification Authority has opened, the next step is to right click the server name
and select “Submit new request” under “All Tasks”. Next, all I need to do is
browse to the location where I saved the request file, in this case that will be the desktop.
Once selected, press open and the request will be added.
To issue the certificate, I need to open the container ‘pending requests’. You can
see the request waiting to be issued. To issue the certificate, right click the request and
select “Issue” under “All Tasks”.
The certificate has been issued, but is still not available to AD FS, as it needs to be
exported. To do this, I will select the container “Issued Certificates”. Once opened, you
can see the certificate. For the certificate to be used with AD FS, it needs to be exported.
To do this, I will double click it to open the certificate. Once the certificate is open,
I next need to select the tab “Details” and then on this tab press the button “Copy
to File” to launch the certificate export wizard.
Once I am past the welcome screen, on the next screen I need to select the format that
I want to use to export the certificate. In this case the default option of DER will be
fine. Once I press next, I need to enter in a filename. In this case I will export the
certificate to the desktop. Once the filename has been entered in, I can move on and on
the last screen of the wizard, press finish to export the certificate.
Now that the certificate has been exported I can close these windows and go back to MMC.
The next step is to import the certificate to the local store so that Active Directory
Federation Services can access it. To do this, I will expand down to the personal container,
right click and select the option “Import” under “All Tasks” to launch the import
wizard.
Once I am past the welcome screen, on the next screen I need to enter in the filename
of the certificate to be imported. In this case, I will press browse and then select
the certificate that I stored on the desktop. Once selected, I will press next to move on
to the next screen of the wizard.
The next screen will ask where I want to store the certificate. Since I right clicked on
the “Personal” container to start the wizard the certificate will be stored in here.
This is fine so I will press next to move on. Next all I need to do is press finish
and the certificate will be imported.
The certificate is ready to be used with AD FS, the next step is to install and configure
AD FS. To do this, I will close all these windows and then open Internet Explorer from
the start menu. Windows Server 2008 R2 ships with version 1.0 of AD FS, but I want to download
2.0 and use that one. To find the download I will perform a google search of ADFS 2.0
RTW, RTW standing for release to web. If you have trouble finding this link I have included
it in the references part of this video.
Once the web page has opened, I next need to press the continue button to be taken to
the download section. On the next screen I need to choose if I want to register with
Microsoft to receive updates. In this case I will leave it on the default option of “No,
I do not want to register. Take me to the download” and move on.
On the next screen I need to decide which option I want to download. It is important
to select the correct download for your operating system. In this case I will select the 64
bit version of Windows Server 2008 R2 and save it to the desktop. It is important to
make sure that you use the version on the web rather than the built in version to ensure
you have the latest version that will run on Windows Server 2008 R2.
Once the download has completed, I will close Internet Explorer and then run the downloaded
installer to launch the setup. Once I am past the welcome screen, I will next need to accept
the license agreement. Once this is done, on the next screen I need to select what I
want to install. In this case I will accept the default option of “Federation server”.
The second option “Federation server proxy” you would normally install on a DMZ. This
would allow a computer to access the Federation server without a direct connection to the
internal network.
On the next screen, setup will indicate what additional software is required for AD FS.
The good news is that if any of this software is not already installed on the operating
system, setup will attempt to install the missing software for you automatically. There
should be no need for you to download and install the missing software if all goes well.
Once I press next, the install will start. It does take a few minutes to complete so
I will pause the video and return shortly.
Federation Services has now been installed. Notice the tick box “Start the AD FS 2.0
Management snap-in when this wizard closes” at the bottom of the screen. This will automatically
open the AD FS Management tool when I press finish. I will leave this option on and then
press finish to close the setup.
The AD FS 2.0 Management tool will now open. Even though ADFS is installed, more configuration
is required. You will notice in the middle of the screen, the option “AD FS 2.0 Federation
Server Configuration Wizard”. When I select this, the configuration wizard for AD FS will
start.
On the first screen, I need to decide if this server will be added to an existing farm.
In this case, I do not have any other Federation Servers installed in the HighCostTraining
domain, so I will leave it on the default option of “Create a new Federation Service”.
You would use the second option if you had an existing AD FS farm and you wanted to add
this server to that farm.
On the next screen of the wizard, I need to decide if this install will be a standalone
install or part of a farm. In this case I will leave it on the default option of “New
federation server farm”. The second option will install the server as a stand-alone server.
Regardless which option you choose, you will get the same feature set. The difference is
that with the stand-alone option you will not be able to add an additional server to
form a farm later. If you are not sure, choose the default option of “New federation server
farm” as this gives you more options later on.
On the next screen, I need to decide which certificate to use. Two certificates will
appear because setup will also detect the certificate being used for the stand-alone
CA. From the pull down list, I will make sure that I select the certificate that I created
for use with Active Directory Federation Services and then move on.
On the next screen I need to enter in a service account to use. In this case I will press
browse and then enter in the name of a service account that I created earlier and also enter
in its password. The service account I created is a regular user account. You need to make
sure that you add this user account to the local administrators group on the server,
otherwise Federation Service may not start.
Once I press next I will be given a summary screen of all the options that I chose in
the setup. Once I press next again, the configuration of Active Directory Federation Services will
begin. The process takes a few minutes to complete so I will pause the video and return
shortly.
You can see that the process has completed with 1 warning. This warning refers to setup
not being able to set the SPN on the user account. When the user account was created
I configured the SPN on the user account. Setup will not set the SPN on a user account
if it has already been configured. If you find the SPN is incorrect, you will need to
open the properties of the user account and change the SPN manually.
Once I press close, the setup is complete and Active Directory Federation Services is
now ready to be used, but that I will leave to a later video. Until then, I would like
to thank you for watching and I hope to see you in the next video.