Timothy Heeney| Microsoft Corporation

Discuss the purpose of Identity Federation Explain how to implement Identity Federation Explain how Identity Federation works Basic troubleshooting

User Experience: Sign in with cloud identity Authentication happens in the cloud Users have two IDs – one to access on-premise services & one for Online services Users prompted for credentials even when logged into the domain when accessing Online Services Administrator Experience: Manages password policy in cloud & on premises Password reset for on premises & MS Online IDs No 2 Factor Authentication integration

User Experience: Users Sign in with corporate ID Authentication happens on premises Users have a single credential to provide SSO to on premises and Online services Users get true SSO experience 2 factor Authentication can be utilized if it is deployed on-premise Administrator Experience: Manages password policy on premise only Password reset for on premise IDs only 2 Factor Authentication integration options Requires additional servers to enable identity federation so there will be an additional up front cost

For any of the thick client to work properly for SSO you need to have the service connector installed

Installs client and operating system updates to enable best sign-on experience. Some of these updates are hotfixes and are not available through normal Windows Update procedures Enables authentication support for rich clients Ensures clients have all needed configuration data to enable service usage Service connector can be deployed or installed locally by the user if they have local Admin Privileges The SSO client is also needed on the Exchange/ADFS/ servers in order to connect to Online Services

Ensure there is a valid UPN for the on-premise users Install Certificate Authority or deploy a third party certificate Install AD FS 2.0 and configure AD FS 2.0 Microsoft Online Services Identity Federation Management tools Implement Directory Synchronization

Users need an External UPN suffix (contoso.com not Contoso.local) You can add this in AD Domains and trusts as an alternate UPN You can use ADUC to change the users to use this new UPN You can use ADMODIFY to change the users to use this new UPN Needed so verification can occur (public CNAME record)

With Identity Federation users will be redirected to the AD FS endpoint over https Enterprise CA to be able to create a certificate to be used for AD FS endpoint or we can use a third party cert with the proper names A token signing certificate is also used for validating the claims made by the on premise AD FS with the MFG IIS needs to be installed on the AD FS server and the certificate that was issues to the AD FS server needs to be bound to port 443 on that server Third party certificates can also be used as long as there is a private key with the certificate

Download and install AD FS 2.0 Instruction on the portal Full SQL instance is optional requires command line install − ADFSSetup.exe /quiet − FSConfig.exe CreateSQLFarm − FSConfig.exe JoinSQLFarm Then configure AD FS − From the start menu select AD FS 2.0 Management. − Select AD FS 2.0 Server Configuration Wizard

Download and install the MOSID tool (used to establish trust and transfer proper config and certs) this is available from the portal Click Start—All Programs—Microsoft Online Services- - Microsoft Online Services Identity Federation Management Tool Run the following commands: $cred=Get-Credential This command prompts for your Online Admin credentials Set-MSOLContextCredential – MSOLAdminCredential $cred The above set the context of the Powershell as the Online Administrator account. Cmdlet nameDescription Add-MSOLFederatedDomain Add a new identity federated domain Convert- MSOLDomainToFederated Convert a standard domain to an identity federated domain Convert- MSOLDomainToStandard Convert an identity federated domain back to a standard domain Converts users back to Microsoft Online IDs Update- MSOLFederatedDomain Update the identity federated domain Get- MSOLFederationProperty Get the identity federated domain properties Remove- MSOLFederatedDomain Remove the identity federated domain

− Logs are located in the following location C:\users\userAccount\documents\MicrosoftOnline\MSOL-IdentityFederation-date (show the log) − Event logging for AD FS 2.0 − Enable additional logging and verbose logging Edit federation Properties and Enable Verbose Logging in Event Viewer…. To start verbose logging run the following -wevtutil.exe sl “AD FS 2.0 Tracing/Debug” /l:5 -show analytic and debug logs in event viewer -enable debug log in event viewer − “Your organization could not sign you in to this service.” − Link Translation on ISA may be enables − The URL’s are configured incorrectly in ADFS − The MFG Relay Trust URL is correct − Any of the certificates were updated in ADFS but not updated to the MFG

First we browse to redirected to the Identity Provider for the Online Services login.microsoftonline.com Then we type in our address and the realm discover occurs client is redirected to the STS cause Domain part of is federated We send our creds to STS we receive a token in return We send the token to login.microsoftonline.com We receive token from MFG then submit that token to portal.microsoftonline.com Show in WinHTTP Trace

Microsoft Confidential CustomerMicrosoft Online Services 14

Why use a proxy? − Security − Key protection − Client connections terminate at the proxy How do you install the AD FS proxy? − Export the certificate and private key from the AD FS server − Import the pfx file into the AD FS proxy server − Download the AD FS 2.0 installation files

After Identity Federation is configured we need to ensure that DirSync is deployed. When DirSync is configured management of user object will be performed on-premise with the exception of licensing 4. License Users 3. Establish federation and/or coexistence 2. Prepare 1. Plan (Read doc) 1. Plan (Read doc) GO Add and Verify SMTP domains Configure Services Enable CCS for coexistence Configure and perform DirSync License users DNS Administration Online Services Configuration Admin Portal Microsoft Online DirSync Tool Install DirSync Set up Identity Federation Microsoft Online Identity Tool

Used when there is any type of coexistence Provides unified GAL and User account provisioning When DirSync is enabled and configured Users are mastered on-premise and then synchronized to the cloud

© 2010 Microsoft Corporation.