Chapter 9. Building Cloud from Common Identities

This chapter will focus on the implementation of a basic hybrid identity and access management solution. You will learn to configure and manage the Identity Synchronization and Federation environment. Furthermore, we will enable Azure MFA to protect cloud applications. Obviously there are many configuration options. We will try to focus at a beginner and professional level at the same time. So you will find some basic step-by-step instructions, and on the other hand configuration notes for advanced options to address the reader's experience. We will extend this lab with various feature configurations and additional virtual machines in the following chapters.

The following are the topics that we are going to go through in this chapter:

• Creating the basic lab environment

• Installing and configuring the Synchronization and Federation environment

• Creating dynamic groups

• Configuring self-service group management

• Implementing secure remote access and SSO...

Creating the basic lab environment

At the beginning of the chapter we need to provide an example lab infrastructure to follow the steps we give you. You can use this lab configuration, or your own. If you use your own lab configuration, then it's up to you to make the necessary adjustments. For introduction purposes, we will use Azure IaaS to provide the lab environment, but you can also choose an on premise infrastructure based on your virtualization solution. In this chapter, we will use four virtual machines to demonstrate the installation and configuration steps.

Tip

Disclaimer

We will generate the lab on the Azure platform to help you perform tests with a very cost -effective solution. You just need a client, an Internet connection, and the trial versions. Obviously this configuration is not recommended for a production environment.

The following diagram shows the expected lab architecture:

Virtual machines

The lab contains virtual machines installed on a virtual network with two subnets...

Installing and configuring the synchronization and federation environment

In this section, we provide guidance on implementing the basic synchronization and federation environment. We start with a simple infrastructure that just consists of the Identity Bridge, the Web Application Proxy, and small applications to show the main principles in practical use scenarios.

Preparing the group management service account - GMSA

Use the following steps to prepare the group management service account:

1. Log on to the Domain Controller ADS01 with the following credentials:

   • Username: Domain\AdminAccount

   • Password: YourPassword

2. Open a Windows PowerShell prompt with evaluated rights and enter:

   Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)
   

Installing AD FS on IDB01

The following are the steps to install ADFD on IDB01:

1. Log on to the server IDB01 with the following credentials:

   • Username: Domain\AdminAccount

   • Password: YourPassword

2. Open Server Manager.

3. Go to Manage | Add roles and features.

4. Click Next | Next |...

Creating dynamic groups

In this section, we will build dynamic group memberships for different purposes, such as licensing or granting application access. We will divide this section into three main parts:

• Using on premise groups for assigning licenses

• Using PowerShell to assign Office 365 licenses based on groups

• Using groups for application access assignment

  Tip

  You also have the option to use a custom Active Directory Attribute; see the following link to the solution: http://bit.ly/2afrAan.

With the following configurations you can access the capabilities of group management in a hybrid identity and access management infrastructure. Let's start!

Using on premise groups for assigning licenses

First of all, we need to identify the different licenses that are available on our Azure tenant. Basically, we do this with the following procedure:

1. Open PowerShell.

2. Use Connect-MsolService to connect to your Azure AD tenant with your Global Administrator account.

3. With Get-MsolAccountSku you will receive the...

Configuring self-service group management

With the next use case we provide the capability for self-service application access management to applications. We will use the example to enable the user to request a controlled set of social media applications in the Access Panel UI:

1. Log on to your Azure AD Management with Global Administrator.

2. Choose the C ONFIGURE section and scroll down to Users who can use self-service for security groups = Enabled.

3. Go to https://myapps.microsoft.com and create a new security group called social Media Applications that is open to join.

4. Log on to the Azure Management Portal (AAD) as global administrator.

5. Under APPLICATIONS add some applications such as Facebook, LinkedIn, and Instagram and assign the group Social Media Applications.

6. Now log on to https://myapps.microsoft.comwith another test user and join the Social Media Applications group.

7. After joining the group, refresh the browser and you should see the assigned applications.

   

Implementing secure remote access and SSO for on premise web applications

Now that we have worked with the basic Identity Bridge and the starter off the group capabilities, we will start to publish on premise applications with the Web Application Proxy in our environment. Right now we will focus on a Claims-based and Kerberos-based application.

Publishing a Claims-based application

The Claims Web Application will be used as a representation of a claims-based line of business application. With this implementation you can try different claims rules and view the results in the application. Earlier in this chapter we installed and configured the application. Now we will publish the app with the Web Application Proxy URA01:

1. Log on to URA01 with the following credentials:

   • Username: Domain\AdminAccount

   • Password: YourPassword

2. Start the Remote Access Management console in the Administrative tools of the server.

3. The first step is to publish the ADFS components.

4. Go to Tasks | Publish | Next.

5. Go to Preauthentication...

Enabling and configuring Multi-Factor Authentication

After implementing the basic publishing for our on premise applications we start to integrate the Multi-Factor Authentication to protect applications with a higher security profile, which we will extend in the next chapters.

Device Registration Service (DRS)

The first mechanism we enable is the device registration service on our ADFS infrastructure:

1. Log on to ADS01 with the following credentials:

   • Username: Domain\AdminAccount

   • Password: YourPassword

2. Open an evaluated PowerShell.

   • Username: Domain\AdminAccount

   • Password: YourPassword

3. Open an evaluated PowerShell.

4. Type Update-WebApplicationProxyDeviceRegistration.

5. Provide the same credentials that you used to install the components.

   Note

   Use the following guidance to join a device in your local Active Directory: http://bit.ly/1IjZJQn. Try to configure the necessary claim rules discussed in the previous chapters to get familiar with the integration of the device in the authentication and authorization...

Summary

Working through this chapter enabled you to configure and manage your first hybrid Identity Management scenario with the basics of the central role of the Identity Bridge. In special we didn't use the assistant of the AAD Connect tool to provide you the inside of the technologies under the hood. The assistant is quite easy to understand. You are also able to address and implement the relevant security features such as claim rules, several group management ideas, and the different authentication mechanisms. This helps you to fulfil the security requirements of an organization and provide suitable solutions. In the next chapter, we will extend this basic implementation with the Azure MFA server to secure your on premise applications and services.

Furthermore, we will deploy the first information protection solution combined with more conditional access control mechanisms. And if this is not enough, we will add some new relevant features from the new Windows Server 2016. Are you ready...