You're reading from Active Directory Administration Cookbook - Second Edition

Product typeBook

Published inJul 2022

PublisherPackt

ISBN-139781803242507

Edition2nd Edition

Concepts

Identity Management

Author (1)

Sander Berkouwer

Chapter 14: Handling Authentication in a Hybrid World (AD FS, PHS, PTA, and DSSO)

Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management service. Organizations can register for an Azure AD tenant, where they can store and use the information on their identities.

Hybrid identity is Microsoft Marketing speak for connecting an on-premises Active Directory environment to Azure AD. When done correctly, the hybrid identity implementation allows end users to authenticate to both on-premises and cloud-based applications, systems, and services:

When accessing Windows NT Lan Manager (NTLM)-based, lightweight directory access protocol (LDAP)-based, and Kerberos-integrated applications, systems, and services, the on-premises Active Directory takes care of authentication and authorization. These protocols are designed for safe networks and have been offering Single Sign-On (SSO) for decades.
When accessing cloud-based applications, systems...

Choosing the right authentication method

This recipe shows how to choose the right authentication method between Active Directory and the Azure AD tenant.

Getting ready

To make a choice, you'll need to understand the following characteristics of your organization:

Is your organization OK with synchronizing secrets to the (public) cloud for end users?
Does your organization already have a federation solution and use claims-based applications inside your organization or cloud-based applications, systems, and/or services?
Does your organization rely on on-premises multi-factor authentication solutions?
Is your organization's Security Incident and Event Monitoring (SIEM) solution cloud-aware?
Do people in your organization use Internet Explorer, Edge, or another browser as their default browser?

How to do it...

Use the following flowchart to choose the proper authentication method for your organization:

Figure 14.1...

Signing up for Azure AD

The recipes in this chapter are based on Azure AD. If your organization doesn't have an Azure AD tenant, use this recipe to create one.

Getting ready

You'll need a valid email address and phone number to sign up for Azure AD.

How to do it

https://signup.microsoft.com/Signup?OfferId=B07A1127-DE83-4a6d-9F85-2C104BDAE8B4.

Provide a valid email address.

How it works…

The preceding link creates a non-expiring tenant with a 30-day Microsoft Office 365 E3 trial license. You specify an account with the Global administrator role during the process of signing up.

The URL in this recipe includes a form. It provides a way to name the Azure AD tenant. This is a plus because many other signup methods base the tenant's name on the domain name in the email address of the person signing up.

Note that you will not receive unsolicited email messages from...

Verifying your DNS domain name

Any hybrid identity journey starts with verifying your DNS domain name in Azure AD. This recipe explains how to do this.

Getting ready

If the organization uses the Azure AD Privileged Identity Management (PIM) feature, activate the Global administrator role or the Domain Name administrator role in advance.

How to do it...

Perform the following steps in the Azure AD Tenant:

Navigate to https://aad.portal.azure.com in your browser.
Sign in with an account that has the Global administrator role or the Domain Name administrator role assigned to it.
Perform multi-factor authentication when prompted.
In the left-hand navigation pane, click Azure Active Directory.
In the Azure AD pane, click Custom domain names:

Figure 14.2 – Custom domain names in the Azure Active Directory admin center window

In the top-level bar, click + Add custom domain. The Custom domain name blade appears on...

Implementing PHS with Express Settings

This recipe shows you how to configure PHS as the authentication method toward Azure AD, using Azure AD Connect Express Settings.

This recipe assumes your organization already possesses an Active Directory domain and Azure AD tenant.

Getting ready

Dedicate at least one domain-joined Windows Server system on the internal network as the host for Azure AD Connect for your organization. As this Windows Server will have a SQL Server Express database hosted on it, be sure not to combine this role with sensitive or overburdened hosts.

Ensure all accounts in the on-premises Active Directory are configured with a publicly routable userPrincipalName suffix, such as lucernpub.com. Ensure the DNS domain name(s) that are part of the userPrincipalName attributes for user accounts are owned by your organization on the internet and configured as verified DNS domain name(s) in your organization's Azure AD tenant.

Additionally, ensure that the...

Implementing PTA and Seamless SSO

This recipe shows how to configure Azure AD Connect with PTA and Seamless SSO.

Getting ready

To implement PTA, you'll need to sign in with an account that is a local administrator on the server dedicated to Azure AD Connect. As part of the steps of this recipe, you'll need to enter the credentials for the following accounts:

An account in Active Directory that is a member of the Enterprise Admins group
An account in Azure AD that has the Global administrator role assigned

Ensure the Windows Server that will run Azure AD Connect meets the following requirements:

It can communicate with the internet without passing proxies.
It is running Windows Server 2016 or later.
It is domain-joined.
It has the IE ESC feature turned off.

If proxies need passing, take appropriate measures by making a proxy exception or configuring a proxy for Azure AD Connect in its configuration file.

Ensure that...

Implementing SSO using AD FS

This recipe shows how to configure an AD FS farm, consisting of one AD FS server and one publicly available Web Application Proxy for SSO.

Getting ready

While the recipes in Chapter 13, Managing Federation, showed how to build an AD FS farm, for this recipe, we'll use the built-in capability of Azure AD Connect to configure two Windows Server 2022 installations as an AD FS server and Web Application Proxy, respectively.

You'll need one domain-joined Windows Server installation running Windows Server 2016 or a newer version of Windows Server to install Azure AD Connect. Ensure this Windows Server can communicate with the internet without having to pass proxies, is domain-joined, and has IE ESC turned off. If proxies need passing, take the appropriate measures by making a proxy exception or configuring a proxy for Azure AD Connect in its configuration file.

For this recipe, you'll need two domain-joined Windows Server installations...

Managing AD FS with Azure AD Connect

This recipe explores how to manage an AD FS farm with Azure AD Connect.

Getting ready

For this recipe, you'll need the following:

A properly configured AD FS farm running Windows Server 2012 R2 or a newer version of Windows Server
A properly configured Azure AD Connect installation, capable of communicating with the AD FS server(s) and Web Application Proxy server(s) in the AD FS farm using TCP 5985

Sign in to the Windows Server installation with Azure AD Connect with an account that is a member of the local Administrators group.

If the organization uses the Azure AD PIM feature, activate the Global administrator role or the Hybrid Identity administrator role in advance.

How to do it...

First, perform the following steps:

Open Azure AD Connect from the desktop.
In the Welcome to Azure AD Connect screen, click Configure.
In the Additional tasks screen, select the Manage federation ribbon.

Implementing Azure Traffic Manager for AD FS geo-redundancy

This recipe shows how to implement a geo-redundant AD FS deployment consisting of two AD FS servers and two Web Application Proxies, equally distributed over two geographically dispersed data centers.

Getting ready

For this recipe, we'll assume that an Active Directory domain exists with domain controllers in a networking environment consisting of two separate, geographically dispersed data centers. Each data center is defined as an Active Directory site. The traffic required for Active Directory replication is allowed, as is TCP 80 between the AD FS servers.

Perform the steps from the Installing the AD FS server role recipe in Chapter 13, Managing Federation, to install the AD FS server role on two Windows Server installations, each running in a separate, geographically dispersed data center. Perform the steps from the Setting up an AD FS farm with Windows Internal Database recipe in Chapter 13, Managing Federation...

Migrating from AD FS to PTA for SSO to Office 365

This recipe shows how to change the sign-in method from federation with AD FS to PTA and Seamless SSO.

Getting ready

Ensure the organization has not implemented heavy customizations to the onload.js page of the AD FS sign-in pages or relies on on-premises multi-factor authentication solutions.

To configure the sign-in method within Azure AD Connect, you'll need to sign in with an account that is a local administrator on the server dedicated to Azure AD Connect. As part of the following steps, you'll need to enter the credentials for these accounts:

An account in Active Directory that is a member of the Enterprise Admins group
An account in Azure AD that has the Global Administrator role or the Hybrid Identity Administrator role assigned

Ensure the Windows Server running Azure AD Connect can communicate with the internet without having to pass proxies and has IE ESC turned off.

If the organization...

Making PTA (geo)redundant

This recipe shows how to install additional PTA agents to make PTA (geo)redundant.

Getting ready

To register additional PTA agents with Azure AD, you'll need to sign in with an account that is a local administrator on the Windows Server installation you plan to run the PTA agent on. As part of the following steps, you'll need to enter the credentials for these accounts:

An account in Active Directory that is a member of the Enterprise Admins group
An account in Azure AD that has the Global administrator role assigned

Ensure the Windows Server running the additional PTA agent is domain-joined, able to communicate with the internet without having to pass proxies, is running Windows Server 2016 or a newer version of Windows Server, and has IE ESC turned off.

Download the PTA agent from the following URL:

aka.ms/getauthagent

If the organization uses the Azure AD PIM feature, activate the Global administrator role in...

The rest of the chapter is locked

You have been reading a chapter from

Active Directory Administration Cookbook - Second Edition

Published in: Jul 2022Publisher: PacktISBN-13: 9781803242507

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at $15.99/month. Cancel anytime

Author (1)

Sander Berkouwer

Sander Berkouwer calls himself an Active Directory aficionado; he's done everything with Active Directory and Azure AD, including decommissioning. He has been MCSA, MCSE, and MCITP-certified for ages, an MCT for the past 5 years and a Microsoft Most Valuable Professional (MVP) on Directory Services and Enterprise Mobility for over a decade. Sander is also decorated with Veeam Vanguard and VMware vExpert awards for his international cross-platform knowledge, experience and passion. As the CTO at SCCT, Sander leads a team of architects performing many projects, most of them identity-related, throughout Europe.
Read more about Sander Berkouwer

Personalised recommendations for you

Based on your interests and search pattern

Et al.

Ever wonder why speech recognition systems don't understand the Scottish accent, or what would happen if an astronaut only ate mac 'n' cheese, or other spurious reflections you'd have at a bar? We did, then collated those deliberations into absurd research articles with fake figures and methodologies inspired by even more fictionally absurd studies.

BookAug 2023230 pages5

Generative AI with LangChain

This book is a comprehensive introduction to LLMs and LangChain, demystifying the basic mechanics of LangChain, its functionalities, and the myriad of applications it can be integrated into.

BookDec 2023360 pages4

Generative AI with LangChain

This book is a comprehensive introduction to LLMs and LangChain, demystifying the basic mechanics of LangChain, its functionalities, and the myriad of applications it can be integrated into.

BookDec 2023360 pages5

Generative AI with LangChain

This book is a comprehensive introduction to LLMs and LangChain, demystifying the basic mechanics of LangChain, its functionalities, and the myriad of applications it can be integrated into.

BookDec 2023360 pages1

Generative AI with LangChain

This book is a comprehensive introduction to LLMs and LangChain, demystifying the basic mechanics of LangChain, its functionalities, and the myriad of applications it can be integrated into.

BookDec 2023360 pages5

Mastering Tableau 2023

This book is a comprehensive resource to mastering your Tableau skills and becoming a BI expert. As you progress, you will learn how to build advanced dashboards and improve your storytelling to derive key business insight, as well as make you well-versed with advanced functionalities of Tableau in the business intelligence domain.

BookAug 2023684 pages

Building AI Applications with ChatGPT APIs

This guide covers all ChatGPT API features for effortless creation of robust AI powered apps. With its help, you’ll be able to leverage ChatGPT’s cutting-edge NLP models to take your app development skills to the next level. You’ll also work on ten exciting projects that will give you the practical know-how that you can apply to your existing applications.

BookSep 2023258 pages5

Building AI Applications with ChatGPT APIs

This guide covers all ChatGPT API features for effortless creation of robust AI powered apps. With its help, you’ll be able to leverage ChatGPT’s cutting-edge NLP models to take your app development skills to the next level. You’ll also work on ten exciting projects that will give you the practical know-how that you can apply to your existing applications.

BookSep 2023258 pages2

Data Engineering with AWS

Embark on a journey to master data engineering pipelines on AWS! Our book offers a hands-on experience of AWS services for ingesting, transforming, and consuming data. Whether you're an absolute beginner or someone with basic data engineering experience, this guide is an indispensable resource.

BookOct 2023636 pages5

Modern Data Architecture on AWS

Every organization wants an agile, performant, and cost-effective data platform that meets all their current and future business needs. Purpose-built AWS analytics services and their features play a big part in building such a modern data platform. This book brings to you all the design and architectural patterns that’ll help you achieve this goal.

BookAug 2023420 pages5

Practical Guide to Applied Conformal Prediction in Python

Discover the power of Conformal Prediction with the "Practical Guide to Applied Conformal Prediction in Python." Master the latest techniques to quantify uncertainty in machine learning and computer vision models, and seamlessly apply them to your industry applications.

BookDec 2023240 pages

TinyML Cookbook

With over 70 project-based recipes, the TinyML Cookbook is a practical guide that will help you to get the most out of your microcontrollers. It provides a comprehensive understanding of the theoretical foundations while giving you hands-on experience training ML models for deployment on Arduino Nano 33 BLE Sense, Raspberry Pi Pico, and SparkFun RedBoard Artemis Nano microcontrollers.

BookNov 2023664 pages