Chapter 14. Installing and Configuring the Enhanced Identity Infrastructure

In this chapter, we will configure and manage a multi-forest synchronization and Single-Sign-On High Availability identity and access management environment based on AAD Connect and ADFS to provide the necessary infrastructure for several use cases in a hybrid identity and access management solution. We also work with the capabilities across company borders and publish the most common on premise services, such as Exchange, SharePoint, and Remote Desktop Services. We will have a special look at the integration and use of the Azure AD provided functionalities.

We will cover the following topics:

• Installing and configuring the multi-forest synchronization environment

• Installing and configuring the multi-forest and high availability Federation environment

• Configuring application access with ADFS, WAP, and AAD AP

• Configuring a multi-factor authentication scenario for Conditional Access

Important note for readers

We will have a mix between detailed and high-level configuration steps to get as many scenarios as possible into the chapter. You, as an experienced reader, should be able to configure all the scenarios with your existing knowledge and the information provided in the previous chapters, where we explained all the concepts. We will also jump between different capabilities. Furthermore, we will not provide detailed steps for configuring the services themselves - we will provide you with the necessary references from valid expert blogs on the Internet. Basically, you should use the described azureid.ch and identityplus.ch forests as internal corporate forests - where you can work with several scenarios and easy network configurations. The shown forest idam.ch should be used for network boundary or partner scenarios.

Creating the extended lab environment

At the beginning of the chapter, we need to extend our example lab infrastructure to follow the steps in this guidance. You can use this lab configuration or your own. If you use your own lab configuration, then it's up to you to make the necessary adjustments. For introduction purposes, we will use Azure IaaS to provide the lab environment, but you can also choose an on premise infrastructure based on your virtualization solution. In this chapter, we will use further virtual machines to demonstrate the generic installation and configuration steps.

Note

We will extend our existing lab environment with a new Active Directory forest to configure the multi-forest environment solutions. In the first part, we will use the existing cloud service, so that we can use the same subnets for the solution without any routing, to provide an easy working environment with less troubleshooting, to start the effective configurations.

The following figure shows the expected...

Installing and configuring the multi-forest synchronization environment

In the first configuration step, we will configure Azure AD Connect to work with two Active Directory forests. We will synchronize the two forests with one Azure Active Directory. Afterwards, we will configure AAD Connect in a high-availability scenario, with a second instance as staging server. We close the synchronization section with the configuration of the AAD Connect Health components to monitor the solution.

Configuring AAD Connect to add the additional forest

In this first stage, we will configure AAD Connect to handle two Active Directory forests. To connect to the different forests, you need to configure the required name resolution before we can connect to the other forest. You can archive this through conditional forwarders or secondary DNS zones between the identityplus.ch and the azureid.ch forests. Furthermore, you can do this configuration with two different states: one, with a cross forest Active Directory...

Installing and configuring the multi-forest and high availability Federation environments

In the following section, you will get the information to configure a high available Federation environment.

Building high availability - ADFS and Web Application Proxy in identityplus.ch

In the following steps, we provide the high-level configuration to configure the additional ADFS server in the farm:

1. Log on to the server IDB02 with the following credentials:

   • Username: Domain\AdminAccount

   • Password: YourPassword

2. Open the Server Manager.

3. Manage Add roles and features.

4. Click Next | Next | Next and select Active Directory Federation Services:

   

5. Click Next | Next | Next.

6. Click Install.

7. Wait for the installation to complete and then click Close.

8. Ensure that you are still logged on to IDB02 with the Enterprise Administrator account.

9. Go to Server Manager and click on Configure the federation service.

10. Follow the setup instructions and add the server to the existing farm.

11. Configure an additional A entry to the DNS configuration...

Configuring application access with ADFS, WAP, and AAD AP

In this section, we will provide the high-level steps to use ADFS, WAP, and Azure AD Application Proxy (AAD AP) to publish your hybrid service infrastructure. We will show the use case and refer to valid expert blog entries so that you get an idea of the solution and the necessary configuration steps.

Tip

Remember the steps and explanations from the previous chapters, about publishing Kerberos-based applications. We don't provide the steps again in this chapter.

We used the idam.ch forest and configured the following ADFS relying parties for our scenario cases:

In the following section, we will start to use Azure AD Application Proxy to publish applications.

Using Azure AD Application Proxy to publish applications

In this scenario, we will configure the Azure AD Proxy to publish the Claims Web demo site, to provide you with the principles for this configuration type:

1. Log on to manage.windowsazure.com and navigate to your Azure Active Directory...

Configuring Multi-Factor authentication scenarios for Conditional Access

In this section, we will provide the necessary steps to configure certificate-based authentication that you can use in conditional access scenarios.

To complete the configuration, you need a deployed PKI in your environment, with externally published CRL information. You can use the following test lab guide if you want to deploy a two-tier PKI in your environment:http://bit.ly/292h5Vh.

For the external publishing of the CRL, you can use a website on Azure, such as that in the following example. You just need to change the CRL paths to the newly created website and copy the files. You are able to use FTP to upload the files:

Tip

We used the idam.ch forest to deploy all the different services, including the PKI.

Next, you need to provide a certificate template for the user authentication.

You just need to duplicate the User template and use only the client authentication usage:

Register a new certificate for your administrative...

Summary

After working through this chapter, you should be able to configure and handle an identity and access management solution with multiple forests. You should also be able to provide this functionality across company borders for secure application and information access. We used the approach to provide you the idea for several scenarios, which we always get asked about in our customer discussions, to provide a suitable hybrid structure. It's impossible to bring all the configuration steps into the book, because the page count would explode, so we used qualified references to help you configure such scenarios. Otherwise, we have configured many on premise services. We see it in the field to really provide a hybrid strategy and a lot of services are still on premise; because of this reason, we choose to integrate these configurations.

In the following chapter, we will focus on more extended scenarios and on access management features.