1. Federation and Federated Identity: Part 2 Building Federated Identity Solutions with Forefront Unified Access Gateway (UAG) and ADFS v2 John Craddock Infrastructure and Security Architect XTSeminars Ltd

2. Agenda Federation overview What is Forefront Unified Access Gateway (UAG) UAG Trunks Configuring a Trunk for ADFS v2.0 Adding a claims enabled application to the trunk Using claims authentication with a Kerberos application through Kerberos Constrained Delegation (KCD)

3. Process token Home realm discovery Redirected to partner STS requesting ST for partner user Return ST for consumption by your STS Return new ST Working with Partners Your ADFS STS Your Claims-aware app Active Directory Partner user Partner ADFS STS & IP Redirected to your STS Authenticate Send Token Return cookies and page Browse app Not authenticated Redirect to your STS STST STST STST STST STST STST STST STST App trusts STSYour STS trusts your partner’s STS

4. DEMO Establishing Trust

5. ADFS Availability The ADFS server is a key component Requires high availability Must scale to the authentication demands of your / partner organisation(s) Functionality required from the Internet for remote workers ADFS STS

6. Deployment Options Active Directory Configuration SQL Cluster Firewall & Load Balancer Intranet AD FS 2.0 Farm Perimeter Network ADFS Proxy Farm Firewall & Load Balancer Internet

7. Adding Forefront Unified Access Gateway ADFS v 2.0 Claims aware application UAG Kerberos application Publishes ADFS server Publishes Applications Active Directory

8. Multiple authentication options Forefront Unified Access Gateway Single entry-point for all remote access Service Pack 1 adds support for ADFS v2.0 DirectAccess HTTP/HTTPS Layer3 VPN Application publishing Optimizer modules for Exchange SharePoint CRM Reverse proxy for Web farms Third party support RemoteApps via Integrated Remote Desktop Services Gateway

9. UAG Architecture Windows Server 2008 R2 Windows Network Load Balancing Threat Management Gateway (TMG) Native IPv6 6to4 Teredo IPHTTPS ISATAP DNS64 NAT64 IIS UAG Filter Internal site Portal RDSG SSL Tunnel SSTP Layer 3 IP VPN RRAS Web Application Publishing Denial of Service Prevention Dynamic tunnel endpoints DirectAccess Management Console Session manager SCOM management pack Config and array manager Tracing and logging User manager Forefront components

10. UAG Trunks Evaluate Endpoint Access Settings Evaluate Endpoint Access Settings Authenticate user against authentication servers Authentication Servers Authentication Servers External IP and URL HTTP or HTTPS External IP and URL HTTP or HTTPS UAG Trunk Trunk Portal

11. Creating a Trunk for ADFS v 2.0 Requires UAG SP1 Define the ADFS STS-IP as a UAG Authentication Server Requires federation metadata from the ADFS-IP Define the claim that will be used as the lead value Create an HTTPS Trunk Select the ADFS Authentication server defined previously Don’t forget to run Activate Configuration If things don’t work as expected, an iisreset on the UAG server may solve it

12. Configuring the ADFS Server On the ADFS server define UAG as a relying party Requires the UAG federation metadata Only available via an external URL or via XLM stored in Program Files\Microsoft Forefront Unified Access Gateway\von\InternalSite\ADFSv2Sites\fed\FederationMetadata\2007- 06 On the ADFS server define the appropriate claims to pass in the token (Issuance Transform Rules) On your client computer connect to the ADFS Trunk You should be logged on via ADFS and see an empty portal

13. DEMO Setting up the portal

14. Man in the Middle UAG is acting a the man in the middle between the client and the ADFS server Depending on the client and server versions Channel Binding Token (CBT) will be enforced and authentication will fail Disable CBT on the ADFS server Configured through the Configuration Editor for the Default Website\adfs\ls or via a script See TechNet “Forefront UAG and AD FS 2.0 supported scenarios and prerequisites” https://adfs.example.com

15. Adding Claims Aware Applications Select the application Define name and type Define endpoint policies Specify the application’s internal address Specify how SSO credentials are passed to the published App Define how the application is shown in Trunk portal Activate the configuration

16. DEMO Adding a claims application

17. None Claims Aware Applications None claims aware application can be supported via Kerberos Constrained Delegation Authentication to internal application via Kerberos Shadow accounts required for external users Authentication via SAML security token UAG ADFS Request Kerberos Ticket to APP1 on behalf of user Authenticate to APP1 using Kerberos App1 Authentication & Authorization via Kerberos ticket Domain Controller running KDC

18. Kerberos Constrained Delegation (KCD) KDC UAG Server Tom TGT K-ST Data server Claims Authentication Request Kerberos token with user’s identity Request Kerberos ST with user’s identity K-ST Impersonate user Uses: Kerberos extension Service-for-User-to-Self (S4U2Self)

19. AD UAG Server Object Automatically configured via UAG You must supply the Service Principal Name Backend application must be Kerberos

20. Adding a Kerberos Application As before Select the application Define name and type Define endpoint policies Specify the application’s internal address DON’T specify how SSO credentials are passed to the published App Define how the application is shown in Trunk portal Select the application and change the authentication to KCD Specify the SPN and shadow account identifier Activate the configuration

21. DEMO Adding a Kerberos Application

22. Get Your Certificates Right The UAG server will require an HTTPS certificate for the UAG portal and the ADFS server For example adfsportal.example.com and adfs.example.com Can use a wild card certificate *.example.com Make sure that the UAG server has the root certificate for the ADFS token signing certificate Make sure the client has the root certificate for the UAG server certificates Make sure all CRL distribution points can be resolved The client will check the certificates and CRLs for the UAG client components

23. Virtual Test Environment Internet Corporate DNS Virtual InternetVirtual CorpNet UAG DNS forwarder ISP Virtual ISP provides services for the virtual Internet: DNS, DHCP, CRL distribution point Routes Internet request to / from the corporate NAT Allows client to check CRLs for UAG client components NAT

24. What Next? Build a test lab Get ADFS working first with a claims aware application Try the Microsoft ADFS step-by-step guides Read the ADFS Design and Deployment guides Read the UAG guides for ADFS v 2.0 Deploy UAG into your test environment Publish ADFS v 2.0 and your application Make sure all certificates and CRLs are available

25. More on ADFS and Federation XTSeminars one-day event: Federation and Federated Identity (available June 2011) info@xtseminars.co.uk for more information Get your local Microsoft subsidiary to run the event!

26. Consulting Services on Request Johncra@xtseminars.co.uk John has designed and implemented computing systems ranging from high-speed industrial controllers through to distributed IT systems with a focus on security and high-availability. A key player in many IT projects for industry leaders including Microsoft, the UK Government and multi-nationals that require optimized IT systems. Developed technical training courses that have been published worldwide, co- authored a highly successful book on Microsoft Active Directory Internals, presents regularly at major international conferences including, TechEd, IT Forum and European summits. John can be engaged as a consultant or booked for speaking engagements through XTSeminars. www.xtseminars.co.uk

27. Stay up to date with TechNet Belux Register for our newsletters and stay up to date: http://www.technet-newsletters.be Technical updates Event announcements and registration Top downloads Join us on Facebook http://www.facebook.com/technetbe http://www.facebook.com/technetbelux LinkedIn: http://linkd.in/technetbelux/ Twitter: @technetbelux Download MSDN/TechNet Desktop Gadget http://bit.ly/msdntngadget

28. TechDays 2011 On-Demand Watch this session on-demand via TechNet Edge http://technet.microsoft.com/fr-be/edge/ http://technet.microsoft.com/nl-be/edge/ Download to your favorite MP3 or video player Get access to slides and recommended resources by the speakers

29. THANK YOU