Chapter 5. Shifting to a Hybrid Scenario

After discussing and implementing a cloud-only identity strategy we will explore some necessary information for a transition process into a hybrid IAM architecture with a single or multi forest On-Premise Active Directory environment. In this chapter, we describe the architecture changes and relevant tasks that need to be applied to provide a successful solution shift. This chapter provides you with the big picture; it will be filled with these details in related chapters:

• Identifying the business drivers and changes for a hybrid move

• Special handling for moving to a multi forest Active Directory environment

• Describing the architecture and needed changes

Identifying business drivers and changes for a hybrid move

There are many reasons why a company needs or wants to move to a hybrid IAM strategy. The first relevant argument is that such a strategy builds the base infrastructure to support all other cloud solutions by providing authentication and authorization over company borders. Another very important side-effect is that you start to support new services and workloads. Furthermore, to be realistic, most companies drive their own On-Premise infrastructure, which needs to be integrated and added with additional functionality to support different cloud scenarios. Typical questions you will receive are:

• Does the company need to support different cloud delivery models such as SaaS or PaaS?

• Does the company need to support legacy applications or do they try to move them to the cloud?

• Does the company need a central solution to manage On-Premise and cloud services at the same time?

• Does the company need to integrate external identities to work with...

Special handling for moving to a multi-forest Active Directory environment

Microsoft provides three main integration scenarios that can be used standalone or combined in a hybrid IAM architecture. The first scenario builds the cloud identity scenario which we have already discussed and implemented in the first chapters of the book. The next two scenarios are:

• Synchronized Identities: Azure AD Connect with password synchronization

• Federated Identities: Azure AD Connect and ADFS for federation and local passwords will be used

As you can see, the Azure AD Connect tool is always required for any hybrid scenario you drive. So we need to start the supported topologies so that you can move to a single or multi forest scenario combined with single or multiple Azure Active Directories.

Supported topologies

The following topologies are supported by Microsoft:

• Single Forest mapped to single Azure AD

• This scenario is a commonly used one. Single forest and a single instance of Azure AD. For this scenario...

Describing architectures and needed changes

In this section, we will describe different architectures including the needed changes in big picture scenarios. In particular, we will discuss the integration of On-Premise applications with the whole authentication and authorization strategy. Furthermore, we start to take the first steps in the hybrid usage of MFA and Azure Rights Management Services (RMS) with typical examples.

Authentication integration

Azure AD provides the capability to integrate On-Premise applications with the Azure Active Directory Application proxy service. To use these capabilities, you just need to install the dependent module, the application proxy connector on your existing Windows Server 2012 R2 Web Application proxy server. With this installation and the necessary configuration, you have taken the first step in this hybrid authentication solution. The following figure shows this scenario to provide you with a better idea about this concept:

Note

The Azure Active Directory...

Summary

Now that you have finished working through this chapter, you will be able to identify some business drivers, feature sets, and architecture changes involved in stepping into a hybrid IAM scenario. You are also in a position to handle the special requirements of a hybrid approach with a single or multi forest On-Premise Active Directory. Remember that this chapter just provides overview information. However, don't worry, as we will get into all the details in the next couple of chapters.