Chapter 7. Deploying Solutions on Azure AD and ADFS

What's better than using theory directly in a practical lab activity? Nothing, in our eyes. Working through Chapter 6, Managing Authentication Protocols, you learned about the different authentication methods used in current environments. Now, we'll start to use this knowledge to deploy several scenarios to our Azure AD and Active Directory Federation Services (ADFS). We will help you to understand all the configuration steps for required a suitable authentication environment.

In this chapter, you will extend your current lab environment, install and configure the service we connect, and configure your authentication solution to handle different methods. We use this approach so that you can understand all the stuff from scratch. We highly recommend that you read Chapter 6, Managing Authentication Protocols, before you run through this chapter, which will cover the following topics:

• Basic environment installation and configuration
• Azure AD...

Basic environment installation and configuration

In this chapter, we start to extend our actual simulated on-premises infrastructure with the additional servers we need in order to demonstrate and configure different capabilities. In the following diagram, we introduce the complete environment we'll have configured after working through all the labs in the book:

Lab environment overview

In this chapter, we will add YD1APP01 and YD1URA01 to our environment. YourDomain1 (YD1) is used to identify the machine in the correct domain. In our case, we used INODEMOAPP01 as an example. You need to provision the machines with the previous values.

 

You already deployed the YDADS01 domain controllerinChapter 2, Understanding Identity Synchronization. For all future virtual servers, use the sameAzure subscription, the same resource group, and the same virtual network. Join the virtual machines to your existing Active Directory. For the domain controller installation, we usedinovitlabs.ch as an example. In...

Azure AD authentication deployments

In this section, we will build applications for our users and work through the different authentication mechanisms provided by Azure AD. All the configurations we do in this section will be done with global administrator rights and on the Azure portal, https://portal.azure.com. We will start with Salesforce configuration:

1. Launch the Azure Active Directory blade and click Enterprise applications.
2. Under All applications, click New application:

New application creation context

3. Type Salesforce in the search field:

Salesforce enablement

4. Under Single sing-on, change to SAML authentication:

Choosing SAML as the authentication method

5. Go to the SAML Signing Certificatesection and click Download on Certificate (RAW):

Downloading the signing certificate

6. Now, log in to your Salesforce account and navigate to Identity | Single Sign-On Settings.
7. Edit the SAML settings and click SAML Enabled:

Configuration of SAML in Salesforce

8. Next, we will create new SAML Single Sign-On Settings...

ADFS Authentication deployments

To configure a claims-based application with WS-Federation, we can use our claims demo application. With this application, you can test many features of ADFS with claims authentication and learn in a more practical way. Run the following configuration on yourYD1ADS01. Later, we'll configure the application to get more experience:

1. Go to Server Manager, click Tools, and open ADFS Management.
2. Expand Trust Relationships and select Relying Party Trusts.
3. Select Actions, add Relying Party Trust, and click Start.
4. In the box, type https://claims.inovitdemos.ch:

ADFS relying party trust configuration

5. Click Next.
6. Type the display name as claims Demo Web Site and click Next.
7. Select I do not want to configure multi-factor authentication settings for this relying party trust currently and click Next.
8. Select Permit all usersto access this relying party, and click Next | Next.
9. Clear the Open the Edit Claim Rules dialog boxfor this relying party trust when the wizard closesand click...

Integrating Azure MFA (YD1ADS01)

In this section, we just integrate Azure MFA into our ADFS farm. We will customize and use this option in Chapter 8, Using Azure AD App Proxy and Web Application Proxy:

1. First of all, we need to generate a certificate for Azure MFA on each server using the following cmdlet:

# Replace the tenant ID to your value
$certbase64 = New-AdfsAzureMfaTenantCertificate -TenantID 181031inovitdemos.onmicrosoft.com

2. Next, we set the certificate as the new credential against the Azure Multi-Factor Auth client:

# Connect to the MsolService with your global administrator rights
Connect-MsolService

# Create a new Service Principal Credential the AppPrincipalId is the hardcoded one for Azure MFA
New-MsolServicePrincipalCredential -AppPrincipalId 981f26a1-7f43-403b-a875-f8b09b8cd720 -Type asymmetric -Usage verify -Value $certBase64

3. Now, we can configure the ADFS farm:

Set-AdfsAzureMfaTenant -TenantId 181031inovitdemos.onmicrosoft.com -ClientId 981f26a1-7f43-403b-a875-f8b09b8cd720
...

Summary

A lot of practical work, hopefully you liked it! From our perspective, it's always the best to work directly with the authentication methods and capabilities you have just learned. Working through this chapter moves you to touch Azure AD and ADFS to provide several authentication methods. We know that we have many pre-configuration tasks, but it helps you to know the application configurations and to apply the correct authentication configuration. You touched on WS-Federation, SAML, and OAuth2 methods, including Azure AD's user provisioning capabilities.

In the next chapter, we will dive further into the different authentication scenarios and also put the application proxy features in place. We'll be happy to see you in Chapter 8, Using Azure AD App Proxy and Web Application Proxy.