Active Directory Federation Services 2.0 Deep Dive: Deploying a Highly Available Infrastructure

Brian PuhlTechnology ArchitectMicrosoft IT

SIM401

Agenda

ADFS Roles/FunctionsDeployment TopologiesManagement Operations

Why Bother?

ADFS is your identity interface to the cloudClaims based authenticationApplication portabilitySaaS adoption – O365, etc…

The expectation from your users and applications, is that ADFS is as seamless and transparent as Active Directory

`

Internal Client

Federation ServerFederation Server

Web Server

Active Directory

ADFS in Action

A. DatumAccount Forest

Trey ResearchResource Forest

Federation TrustFederation Trust

Microsoft(Users)

E-Company Store(Resource)

Contoso(Users)

Fabrikam(Resource)

High Availability/Disaster Recovery

Factor in High availability and disaster recovery plans into service architecture2 or more ADFS server farms in different data centersBack end SQL store comprise of minimum 2 node clusters located in multiple DCs

Mirrored against one another for failover

STS Services configured for SQL failover

Deployment Topology

Site1 Site2

MSIT.adfs.microsoft.com

Extranet

Corpnet

Extranet

Corpnet

MSIT.adfs.microsoft.com

Mirrored Clusters

Deployment Topology

Site1 Site2

MSIT.adfs.microsoft.com

Extranet

Corpnet

Extranet

Corpnet

MSIT.adfs.microsoft.com

Mirrored Clusters

Federation Service (FS)

Security Token Service (STS) Maps user attributes to claimsIssues security tokens

Manages federation trust policies, claim rules

Deployment Topology

Site1 Site2

MSIT.adfs.microsoft.com

Extranet

Corpnet

Extranet

Corpnet

MSIT.adfs.microsoft.com

Mirrored Clusters

Client proxy for token requestsProvides UI for browser clients

Forms based authHome realm discovery

Federation Service Proxy (FS-P)

Configuring DNS

Users should always contact their “local” ADFS instanceInternet users must resolve to the FS-P serversThe FS-P’s must resolve to the FS serversInternal users must resolve to the FS servers

SolutionWe chose a dedicated namespace which we could host both internally and externally.

<instance>.sts.microsoft.com

Load Balancing

Internet

DMZ

Intranet

Geographic DNS

Load Balanced

Load Balanced

Ability to shift or balance traffic between data centers

Hardware load balancers enable quick response to server failures

Internal load balancers provide high availability

Load Balancing

Internet

DMZ

Intranet

Use HOST files to create pairs of Federation Servers and Proxies

Use HOST files to direct Proxy to FS-servers

Operations processes for managing a failed Fed Server

Add server name to common pages (HRD, Login, Error)

<%=System.Environment.MachineName %>

Deployment Topology

Site1 Site2

MSIT.adfs.microsoft.com

Extranet

Corpnet

Extranet

Corpnet

MSIT.adfs.microsoft.com

Mirrored Clusters

SQL serverADFS service configurationTrust and claims rule storageSAML artifact storage

SQL Configuration Store

SQL Configuration

Mirrored Clusters

SQL mode of operation: High Performance ModeAsynchronous transactionsMinor risk of loss of token replay and artifacts during fail overRequires low latency between clusters to keep consistency

SQL Configuration Server Configuration

ADFS Service Host XML configuration fileC:\program files\Active Directory Federation Services 2.0\Microsoft.identityServer.ServiceHost.exe.config

<microsoft.identityServer.service> <policyStore connectionString="Data Source=SQL1.contoso.com; Initial Catalog=AdfsConfiguration; Integrated Security=True; Failover Partner= “SQL2.contoso.com" administrationUrl="net.tcp://localhost:1500/policy" /> <trustMonitoring enabled="true" /> </microsoft.identityServer.service>

SQL Configuration Requirements

Repeat process for artifact store (Powershell)

PS C:\Windows\system32> get-ADFSProperties | %{$_.ArtifactDbConnection}

Data Source=SQL1.contoso.com;Initial Catalog=AdfsArtifactStore;Integrated Security=True;Failover Partner=SQL2.contoso.com

`

Internal Client

Federation ServerFederation Server

Web Server

Active Directory

ADFS in Action

A. DatumAccount Forest

Trey ResearchResource Forest

Federation TrustFederation Trust

Microsoft(Users)

E-Company Store(Resource)

Contoso(Users)

Fabrikam(Resource)

Claims Pipeline

A. DatumAccount Forest

Trey ResearchResource Forest

Contoso(Users)

Fabrikam(Resource)

Accept Incoming Claims

Authorize the Requestor

Issue Outgoing Claims

Accept Incoming Claims

Authorize the Requestor

Issue Outgoing Claims

RP Trust Policy Management

Use Powershell not the UIAllows for quickly recreating/reconfiguring the serviceStore copies of the scripts externally from ADFS

#* Creating new Relying PartyAdd-ADFSRelyingPartyTrust -Name “Fabrikam" -Identifier "https://app.fabrikam.com/" -WsFedEndpoint "https://app.fabrikam.com/_trust/" -Notes "Sponsor Name:Brian Puhl" -TokenLifetime 60

RP Rules Management

@RuleName = "Store:Active Directory, Get Claims"c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"] => add(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"), query=";givenName;{0}", param = c.Value);

@RuleName = "Store:Active Directory, Send givenname" c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"] => issue(claim = c);

Use Powershell not the UIUse the @ operator to set the rule name in the UI

Claims Sources

Master Data Management concepts applyApplications may not need “authoritative” dataInformation in AD may not be the same as the other stores

SQL Attribute StoresMust ALSO be highly available

Custom Attribute Stores

Custom extensibility point for querying attribute stores other than AD, ADLDS, or SQL

Written in .NET – implements IAttributeStore interface

Possible return values:2-dimensional array of [claim type] [claim value]AttributeStoreInvalidConfigurationExceptionAttributeStoreQueryExceptionExceptionAttributeStoreQueryFormatException

Claims Best Practices

Claims Provider Rules apply to all users from that IdP

Custom Attribute Stores MUST return somethingIf the data store is unavailable, return a value to indicate to the application that the claims are not valid

Naming standards for claim types

Publish claim types in federation metadata for consistency

Security Best Practices

Utilize ADFS 2.0 integration with SCWSystematically evaluate ADFSProperties and ADFS Relying Party properties

Set relevant Properties

Set optimal ADFS token lifetime to compliment Resource being securedLeverage Extended Protection for authentication propertyEnsure RPs call signout.aspx to cleanup ADFS cookies

Security Best Practices

Enforce Privacy of PII information.secure custom attribute stores (SQL, WIF)

SQL server specific securityIf Policy/Artifact store = SQL

Implement and Enforce lifecycle on RP/IdP objectsDesign an Elevated Admin access Model Reduce authentication surface area

Enabling relevant authN types on ADFS and Proxy

Review and enable applicable Endpoints and usage

ADFS/SCW unleashed

SCW usage and verificationUse scwcmd to register security role extensions.

SCW Configuration Information

Logging and Creating Usage Reports

Approach

Utilize IIS Log Parser to collect W3SVC events on ADFS serversDownload Log Parser 2.2 from Microsoft.comOnly generated for passive federation

SQL Stored Procedures to parse and insert into SQLAuthor SSRS reports to view data in meaningful views.

# of auths per application realm.

Troubleshooting User Authentications

Error messages include correlation ID which is included in one or more entries in the ADFS 2.0 log

Powershell snippet to query log for correlation ID

BEGIN { $query = "*[System/Correlation[@ActivityID='{" + $CoID + "}']]" $log = "AD FS 2.0/Admin"}PROCESS { Get-WinEvent -computername $computername -LogName $log -FilterXPath $query ` | fl machinename, timecreated, id, message}

Availability and Monitoring

Internal MonitoringSCOM Management Pack

Server availabilityService health

External MonitoringInternet perspective of your servicePowershell scripts or internet providersVerifies end-to-end through all network layersComplex management of DNS records/resolution

Summary

Deploying a high availability ADFS service is similar to any other highly available web applicationSQL configuration is crucialClaims availability can impact ADFS availabilityLeverage Powershell to externally store and manage configuration and trust informationUse IIS Logging and SSRS to manage utilization, capacity, and lifecycle management of the serviceConfigure monitoring from the internet for end-to-end

Track Resources

Don’t forget to visit the Cloud Power area within the TLC (Blue Section) to see product demos and speak with experts about the Server & Cloud Platform solutions that help drive your business forward.

You can also find the latest information about our products at the following links:

Windows Azure - http://www.microsoft.com/windowsazure/

Microsoft System Center - http://www.microsoft.com/systemcenter/

Microsoft Forefront - http://www.microsoft.com/forefront/

Windows Server - http://www.microsoft.com/windowsserver/

Cloud Power - http://www.microsoft.com/cloud/

Private Cloud - http://www.microsoft.com/privatecloud/

Resources

www.microsoft.com/teched

Sessions On-Demand & Community Microsoft Certification & Training Resources

Resources for IT Professionals Resources for Developers

www.microsoft.com/learning

http://microsoft.com/technet http://microsoft.com/msdn

Learning

http://northamerica.msteched.com

Connect. Share. Discuss.

Complete an evaluation on CommNet and enter to win!

Scan the Tag to evaluate this session now on myTech•Ed Mobile

© 2011 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to

be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS

PRESENTATION.