Hey guys welcome back this is Bernardo from the BTNHD and today is all about setting up
Microsoft AD FS, which stands for Active Directory Federation Services.
So let's get right into it alright so today is all about setting up Active Directory Federation
Services.
The reason that I am doing this is because I received an email from Frank Jr.
And he was like, Yo, I'm curious.
Do you have any videos, dealing with Microsoft ADFS, and I went to my channel I searched
for ADFS, because if I had something copy and paste it and send it and I'm done.
And it was zero I didn't have anything so I said to myself, ah, I need to create something
so this is the reason why I'm doing this video.
So first things first on the desktop I'm going to right click on the Start menu go to run,
type in WINVER hit ok so I'm running my entire environment within Windows Server 2019 version
1809, so on the desktop.
I'm going to click on Start and within start I'm going to right click on Windows PowerShell,
then go to more within here I'm going to click on run as an administrator, and within the
command prompt, I am going to type in the following.
I'm going to type in install Windows feature, and the feature that we are going to install
is ADFS dash Federation with a parameter of include management tools, hit enter.
It's going to start collecting the data, install all the features and you're done.
We're going to close out PowerShell.
Click on starts.
Click on Server Manager, and once Server Manager is up and running on your upper right corner,
you're going to see an exclamation point.
So, with the flag.
So we're going to click on that guy, you're going to see a post deployment configuration
setting for your Active Directory Federation services.
So we are going to click on configure the Federation service on this server, you're
going to get the wizard.
I'm gonna leave everything as the default I do want to create the first Federation server
in a federation server farm.
And we are going to click on next there.
I'm going to leave the default as the current user, but you are able to change it, click
Next.
And now for the SSL certificate.
I actually purchased a SSL certificate for this video, which was really cheap it's not
that bad.
So the way that I got the SSL certificate is I installed IIS as you guys can see right
here on the server, I actually have IIS installed, and within there within this server SSL certificate
node, you're able to create a CSR request.
Take that jibberish, you could place it anywhere GoDaddy, Komodo wherever you're going to get
an SSL certificate.
It's going to generate the SSL certificate.
Once you get that you're going to download it and then you're going to import it inside
the IIS Manager.
Hopefully you guys know how to do that.
If not, let me know and I will do a video on that.
Now, I already imported my SSL within this server and if I click on the drop down menu.
I'm going to see the SSL certificate that I imported inside this machine.
So I'm going to select it and automatically the Federation service name will be pre populated
for you.
And then you're going to give it a service display name which I gave it BTNHD labs.
Click on Next there.
Now you're going to get this nice little warning if you click on show more it's going to give
you information, now it gives you the warning of group managed service account, are not
available because of the KDS root key has not been set, press ok they're open up PowerShell
I'm going to show you guys how to set it you're going to run the following command of add
dash KDS root key with a parameter of effective immediately hit enter.
Now, if you go back, go to previous and then go next.
Again, you're going to see that create a group managed service account is enabled.
Now for this video i'm not going to use that option I'm actually going to use an existing
domain user account or group managed service account.
So I'm going to click on select.
I'm going to provide a user account, click OK.
You're going to provide your account password once you're done there click on next it's
going to take you here from me or you have an option to actually create a database using
Windows internal database, or if you have a SQL Server database you are able to, you
know, configure it that way.
So I'm gonna leave it as the default, which is actually using Windows internal database
and then click Next.
From here we are going to click on Next.
All the prerequisites checked out with no problem and then click on configure, I did
get a couple of warnings and I need to look up why I got these warnings, but I was still
able to sign in.
Within the ADFS signed in, website one of the warnings is that you need to restart your
machine.
Now before you close and restart your machine I created an A record of ADFS, because that's
actually the SSL certificate, that is the Federation service name that I created so
I just make sure I created A record as well as created an associated pointer record, and
just click Add host.
Everything was created successfully.
Awesome.
And just restart your machine.
Once you restart your machine log back in you're inside Server Manager and what you
want to do is open up your favorite browser I open up Chrome, and you want to type in
the following address.
So again, ADFS dot BTNHD.
COM And all this stuff next to it.
this information I actually got it within the Microsoft technics site.
So when I hit Enter.
I was like, oh okay got it it's loaded up.
No problem.
I didn't get that 404 error message with a webpage, but I got this and error occurred.
Okay, oh what happened.
So I clicked on error details, and I got all this gibberish so I'm saying what the hell
is this this is alien talk.
right.
So I clicked on a start menu.
I went to Windows administrative tools, and I know that the ADFS has his own management
so I found the Active Directory Federation service management, and I clicked on it.
And it looks like I needed to add a trusted relying party so that's the only thing that's
incomplete so I clicked on that I follow the prompts I left everything as the default click
on start here for my Federation, address, I added the ADFS dot btnhd.com.
Hit next there.
Let the display name as the default click on next and then you're able to actually choose
the Access Control Policy.
Now by default, I think it's actually set as to permit everyone, I recommend that you
go over all the policies and configure it the way that you want it within your nine
to five environment, but for now for this video i'm leaving it as permit everyone and
then click Next.
You have ready to add the trust, I will recommend going to each tab, making sure everything
looks good, within your environment and once you're done click on Next.
And then you're able to close and then I went back to the site, refresh, and I still got
the same problem so I said to myself, what is going on so it looks like that web page
that we're trying to access or sign into is disabled by default.
Now if you run the following command within PowerShell and you hit enter is going to state
false right because that's what Microsoft stated on their site by default that page
is turned off.
Don't know why.
Now to turn it on.
It's pretty easy.
You're going to run the following command and just make sure you set it to true hit
enter.
If you run the same command that we did at the very beginning to check the value and
you hit enter, it's going to say true now if you open up your browser and you go back
inside that URL, it should work.
Now I use Internet Explorer, it doesn't really matter which one you use the only reason that
I use Internet Explorer because Internet Explorer actually allows me to add a local intranet
and I added my web address, which is https colon whack whack ADFS dot BTNHD com so I
added that within the intranet.
That's actually one of the recommendations that Microsoft added within their site.
So once I did that, I went back inside the page.
This looks good.
I didn't get an error awesome I clicked on sign in, and once I'm signed in, it says you
are signed in.
Awesome.
Again this is only the setup and configuration part just the installation part of basically
Active Directory Federation services.
I'm not going to kill this machine as of yet because I might play with it a little bit
more and see what else I could do with this guy.
Hopefully you guys enjoy this video make sure to hit that thumbs up.
Do not forget about punch, elbow and smashing that subscribe button to get the latest and
greatest from this guy and I catch you guys on the next one.
Peace out.