{"id":7261,"date":"2013-02-18T17:58:09","date_gmt":"2013-02-18T22:58:09","guid":{"rendered":"http:\/\/jianmingli.com\/wp\/?p=7261"},"modified":"2017-06-13T23:00:49","modified_gmt":"2017-06-14T04:00:49","slug":"adfs","status":"publish","type":"post","link":"https:\/\/jianmingli.com\/wp\/?p=7261","title":{"rendered":"ADFS 2.0 Install"},"content":{"rendered":"
\n

Contents<\/h2>\n
    \n\t
  1. \n\t\tOverview<\/a>\n\t\t
      \n\t\t\t
    1. \n\t\t\t\tKey Features<\/a>\n\t\t\t<\/li>\n\t\t<\/ol>\n\t
    2. \n\t\tInstall<\/a>\n\t<\/li>\n\t
    3. \n\t\tGenerate a Web Server Certificate<\/a>\n\t<\/li>\n\t
    4. \n\t\tADFS 2.0 Federation Server Configuration Wizard<\/a>\n\t<\/li>\n\t
    5. \n\t\tRenew Certificates<\/a>\n\t\t
        \n\t\t\t
      1. \n\t\t\t\tRenew IIS Certificate<\/a>\n\t\t\t<\/li>\n\t\t\t
      2. \n\t\t\t\tSet Service Communications Certificate<\/a>\n\t\t\t<\/li>\n\t\t\t
      3. \n\t\t\t\tRenew ADFS Certificates Immediately<\/a>\n\t\t\t<\/li>\n\t\t\t
      4. \n\t\t\t\tExport and Import Token Signing Cert into JBoss Trust Store<\/a>\n\t\t\t<\/li>\n\t\t<\/ol>\n\t
      5. \n\t\tInstall Cumulative Update 3 (CU3)<\/a>\n\t<\/li>\n\t
      6. \n\t\tIssues<\/a>\n\t\t
          \n\t\t\t
        1. \n\t\t\t\tA timeout was reached (30000 milliseconds) while waiting for the AD FS 2.0 Windows Service service to connect.<\/a>\n\t\t\t<\/li>\n\t\t<\/ol>\n\t
        2. \n\t\tReferences<\/a>\n\t<\/li>\n<\/ol>\n<\/ol>\n<\/div>\n
           <\/div>\n

          Overview<\/h2><\/span>\n

          * ADFS is a component in Windows Server 2003 R2 which comes with ADFS 1.1. ADFS 2.0 is a downloadable update.
          \n* Tightly integrated with AD:
          \n– retrieves user attributes from AD
          \n– authenticates users against AD
          \n– uses Windows Integrated Authentication (WIA)
          \n* Works with both AD and ADAM (AD application mode, aka AD LDS)
          \n* Provides web SSO by securely sharing digital identity and entitlement rights, or Claims, across security and enterprise boundaries
          \n– can translate terms that are used in the organization into claims
          \n– create, secure and verify claims that move between organizations
          \n– audit and monitor activity between organizations and departments
          \n* Works with both Windows Internal Database (WID) ans SQL Server
          \n– SQL Server support SAML artifact resolution and token replay detection<\/p>\n

          Key Features<\/h3><\/span>\n

          * Supports both active (WS-Trust) and passive (WS-Fed and SAML 2.0) scenarios.
          \n* Federation and Web SSO
          \n– extends Windows integrated authentication to internet facing applications
          \n– federation servers can be deployed in multiple organizations to facilitate B2B federated transactions
          \n* WS-* interoperability
          \n– supports WS-Federation
          \n* Extensible architecture, supports:
          \n– SAML token type
          \n– Kerberos authentication
          \n– can also perform claim mapping<\/p>\n

          Install<\/h2><\/span>\n

          * Prepare a Windows 2008R2 box and join it into a target domain, e.g. mytest.local<\/em>
          \n* Download ADFS 2.0 RTW (release to web) from           Microsoft Download Center<\/a>, e.g. RTW\\W2K8R2\\amd64\\AdfsSetup.exe
          \n* Double click AdfsSetup.exe to start Setup Wizard
          \n* Select Sever Role: Federation server<\/p>\n

          \"\"<\/a><\/h6><\/span>\n

          * Click Next on Install Prerequisite Software screen<\/p>\n

          \"\"<\/a><\/h6><\/span>\n

          * Finish<\/p>\n

          \"\"<\/a><\/h6><\/span>\n

          Generate a Web Server Certificate<\/h2><\/span>\n

          * See this post<\/a> to generate a web server certificate to be used for ADFS.
          \n* Note that certificate common name needs to be a long name<\/em>, i.e. with domain name. For example, adfs01.mytest.local<\/em>.<\/p>\n

          ADFS 2.0 Federation Server Configuration Wizard<\/h2><\/span>\n

          * Open Start > Admin Tools > ADFS 2.0 Management<\/em>
          \n* Click AD FS 2.0 Federation Server Configuration Wizard<\/em>
          \n* Select Create a new Federation Service<\/p>\n

          \"\"<\/a><\/h6><\/span>\n

          * Select Stand-alone federation server<\/p>\n

          \"\"<\/a><\/h6><\/span>\n

          * Specify Federation Service Name<\/p>\n

          \"\"<\/a><\/h6><\/span>\n

          * Ready to apply settings<\/p>\n

          \"\"<\/a><\/h6><\/span>\n

          * Done.<\/p>\n

          \"\"<\/a><\/h6><\/span>\n

          Renew Certificates<\/h2><\/span>\n

          Renew IIS Certificate<\/h3><\/span>\n

          * Create a new IIS certificate following this post<\/a>.
          \n* Open a command window and run iisreset<\/em><\/p>\n

          Set Service Communications Certificate<\/h3><\/span>\n

          * From AD FS Management console, set Service Communications Certificate to the renewed IIS certificate:<\/p>\n

          \"adfs2_renew_svcCommCert\"<\/a><\/h6><\/span>\n

          Renew ADFS Certificates Immediately<\/h3><\/span>\n

          * Open a PowerShell command window and run following command:<\/p>\n

          \r\nAdd-PSSnapin Microsoft.Adfs.PowerShell\r\nUpdate-ADFSCertificate -Urgent\r\n<\/pre>\n
          * Open ADFS 2.0 management console and refresh the AD FS 2.0 > Service > Certificates<\/em> folder.<\/p>\n
          \"adfs2_renew_encSignCerts_refresh\"<\/a><\/h6><\/span>\n
          * Restart ADFS 2.0 service.<\/p>\n
          Export and Import Token Signing Cert into JBoss Trust Store<\/h3><\/span>\n
          * Follow previous Export ADFS Token Signing Cert<\/a> section to export the token signing certificate.
          \n* Import exported token signing certificate into JBoss trust store<\/p>\n
          \r\nkeytool -delete -alias adfs01-sign -keystore jboss01_adfs_sign.jks -storepass Welcome1\r\nkeytool -import -v -keystore jboss01_adfs_sign.jks -alias adfs01-sign -storepass Welcome1 -file adfs2_tokenSigning.cer\r\n<\/pre>\n
          * Restart JBoss<\/p>\n
          \r\nservice jboss restart\r\n<\/pre>\n
          Install Cumulative Update 3 (CU3)<\/h2><\/span>\n
          * Download Windows6.1-KB2790338-v2-x64<\/em>
          \n* Double click to install
          \n* Restart computer
          \n* Don’t forget to run this power script:
          \nC:\\program files\\active directory federation services 2.0\\SQL\\PostReleaseSchemaChanges.ps1<\/em>
          \n– Otherwise you might get “the signing certificate of the relying party trust is not unique” error message when you try to add two relying parties that have same signing key.
          \n– See           this discussion<\/a> for details<\/p>\n
          Issues<\/h2><\/span>\n
          A timeout was reached (30000 milliseconds) while waiting for the AD FS 2.0 Windows Service service to connect.<\/h3><\/span>\n
          * Add the entry below to Microsoft.IdentityServer.Servicehost.exe.config<\/em> file, located in the ADFS 2 install directory (default C:\\Program Files\\Active Directory Federation Services 2.0<\/em>):<\/p>\n
          \r\n  \r\n    \r\n  <\/runtime>\r\n<\/pre>\n
          * See here<\/a> for details<\/p>\n
          References<\/h2><\/span>\n
          * ADFS Overview<\/a>
          \n*           AD FS 2.0 Content Map<\/a>
          \n*           Install the AD FS 2.0 Software<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
          Overview * ADFS is a component in Windows Server 2003 R2 which comes with ADFS 1.1. ADFS 2.0 is a downloadable update. * Tightly integrated with AD: – retrieves user attributes from AD – authenticates users against AD – uses … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[346],"tags":[632,141],"class_list":["post-7261","post","type-post","status-publish","format-standard","hentry","category-adfs","tag-adfs","tag-install"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/s8cRUO-adfs","_links":{"self":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/7261","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7261"}],"version-history":[{"count":21,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/7261\/revisions"}],"predecessor-version":[{"id":12039,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/7261\/revisions\/12039"}],"wp:attachment":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7261"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7261"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7261"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}