{"id":406,"date":"2016-03-10T14:59:24","date_gmt":"2016-03-10T19:59:24","guid":{"rendered":"https:\/\/jackhanington.com\/blog\/?p=406"},"modified":"2016-03-10T14:59:39","modified_gmt":"2016-03-10T19:59:39","slug":"install-and-setup-adfs-2-0-on-a-windows-server","status":"publish","type":"post","link":"https:\/\/jackhanington.com\/blog\/2016\/03\/10\/install-and-setup-adfs-2-0-on-a-windows-server\/","title":{"rendered":"Install and Setup ADFS 2.0 on a Windows Server"},"content":{"rendered":"

Note: This guide assumes you have a Windows server, it is joined to a domain and you have an account that is part of the domain admins group.<\/p>\n

\n

 <\/p>\n

First we need to install ADFS 2.0<\/h3>\n
    \n
  1. To install version 2.0, it first needs to be downloaded and installed. Click this link to download the installation file https:\/\/www.microsoft.com\/en-au\/download\/details.aspx?id=10909<\/a><\/li>\n
  2. Choose the type of installation file based on your OS (I am running Server 2008 R2 so I will choose RTW\\W2K8R2\\amd64\\AdfsSetup.exe). Save the installation file to your Desktop<\/li>\n
  3. Run the exe<\/strong> located on your desktop<\/li>\n
  4. On the Welcome screen, click Next<\/strong><\/li>\n
  5. Accept the License Agreement.<\/li>\n
  6. I will be setting this ADFS server as a Federation server so I will leave the default of\u00a0Federation Server<\/strong> selected and I will click Next<\/strong>. Note: you would select Federation server proxy if you were running your ADFS server in something like a DMZ.<\/li>\n
  7. Click Next<\/strong> on the prerequisite software screen. The install wizard will install these automatically if they are not already present on the system. If there are no errors, the software will be installed and the ADFS 2.0 management window will open
    \n
    \n<\/li>\n<\/ol>\n

    The next task is to create a certificate template to use with our SSL certificate<\/h3>\n
      \n
    1. The first thing you need to do is open the Server Manager (Start > Administrative Tools > Server Manager)<\/li>\n
    2. Select Roles<\/strong><\/li>\n
    3. Click Add Roles<\/strong><\/li>\n
    4. Click Next<\/strong> to get past the Welcome Screen<\/li>\n
    5. Check off Active Directory Certificate Services<\/strong> and click Next<\/strong>
      \n      \"Select<\/a><\/li>\n
    6. Click Next<\/strong> to get past the Welcome Screen<\/li>\n
    7. Click Next<\/strong> on the Role Services <\/strong>page<\/li>\n
    8. Leave the default of Enterprise<\/strong> selected and click Next<\/strong>. Note: if Enterprise is not an option, you must log out of the server and log back in using an account that is a member of the Domain Administrators group.<\/li>\n
    9. On the next page you need to decide between choosing a Root CA or a Subordinate CA. Select Root CA if you are OK with using a self-signed certificate for your ADFS instance. Select Subordinate CA if you would like to purchase a certificate from a 3rd<\/sup> party certificate authority. I will be using a self-signed certificate so I will select Root CA<\/strong> and click Next<\/strong>.<\/li>\n
    10. Click Next<\/strong> on the Private Key<\/strong> page to create a new private key.<\/li>\n
    11. Choose the type of cryptography you would like to use on the next page. I will leave the default of SHA1 with a 2048 bit key character length, but you can choose whatever you want. Then click Next<\/strong><\/li>\n
    12. Click Next <\/strong>on the CA Name <\/strong>page<\/li>\n
    13. Choose how long you want the certificate to be valid. I will leave the default of 5 years set. Click Next<\/strong><\/li>\n
    14. Click Next <\/strong>on the Certificate Database <\/strong>page<\/li>\n
    15. Click Install<\/strong> to finish and then close the wizard when complete<\/li>\n
    16. Next open up the Certificate Authority (Start > Administrative Tools > Certificate Authority)<\/li>\n
    17. Expand your server on the left column, right click Certificate Templates<\/strong> and click Manage<\/strong>
      \n      \"manage\"<\/a><\/li>\n
    18. Scroll down to the end of the list, right click Web Server<\/strong> and click Duplicate Template<\/strong>
      \n      \"Duplicate<\/a><\/li>\n
    19. Select Windows Server 2008 Enterprise <\/strong>and click OK<\/strong>. Note: you would select Windows Server 2003 only if you had 2003 servers on your network that needed to access the ADFS services.<\/li>\n
    20. Give the template a name (ex: ADFS SSL Certificate)<\/li>\n
    21. Next click on the Subject Name <\/strong>tab at the top.<\/li>\n
    22. Click the Build from this Active Directory information<\/strong> radio button, select Common Name<\/strong> from the subject name format dropdown, uncheck User principal name (UPN)<\/strong> and check DNS\u00a0name<\/strong>
      \n      \"Template<\/a><\/li>\n
    23. In order for the ADFS server to obtain a certificate, it needs to have the correct permission set up to do so. To do this, select the Security<\/strong> tab at the top.<\/li>\n
    24. To add the required permissions, click the Add<\/strong><\/li>\n
    25. Click the Object Types\u2026 <\/strong>button, check Computers<\/strong> on the newly opened window and click OK<\/strong>.
      \n      \"Object<\/a><\/li>\n
    26. Enter the name of the server that you previously installed ADFS on and click OK<\/strong>. The server will be added to the permission list.<\/li>\n
    27. Next we need to set Enroll the allow permission for this particular server. Check Enroll<\/strong> and click OK<\/strong>
      \n      \"Template<\/a><\/li>\n
    28. Now we need to make this certificate template is available to be used to issue certificates. To do this, open up the Certificate Authority window again (Start > Administrative Tools > Certificate Authority)<\/li>\n
    29. Right\u00a0click the Certificate Templates<\/strong> icon in the left column, hover over New<\/strong> and click Certificate Template to Issue\u00a0<\/strong>
      \n      \"Certificate<\/a><\/li>\n
    30. Select the name of the template you made previously (in my example I made it ADFS SSL Certificate) and click OK<\/strong>.
      \n
      \n<\/li>\n<\/ol>\n

      The next task is to create a SSL certificate on the server that is compatible with ADFS<\/h3>\n
        \n
          \n
        1. Open up a management console window on your server (Start, type in mmc.exe and hit enter)<\/li>\n
        2. Click file and click Add or Remove Snap-ins<\/li>\n
        3. Highlight Certificates<\/strong> and click Add\"Certificates\"<\/a><\/strong><\/li>\n
        4. Select Computer Account<\/strong> and click Next<\/strong> and then click Finish<\/strong><\/li>\n
        5. Now that the options are configured, click OK<\/strong><\/li>\n
        6. On the Console window, click View<\/strong> and then select Options
          \n          \"Options\"<\/a><\/strong><\/li>\n
        7. Select Certificate purpose<\/strong> and then click This will allow us to view the computer\u2019s certificate by their purpose.<\/li>\n
        8. In the Intended Purposes<\/strong> view, right click Server Authentication<\/strong>, hover over All Tasks<\/strong> and click Request New Certificate
          \n          \"Request<\/a><\/strong><\/li>\n
        9. Click Next<\/strong> on the welcome screen.<\/li>\n
        10. Click Next<\/strong> on the Select Certificate Enrollment Policy<\/strong><\/li>\n
        11. Select the template you created before (ex: ADFS SSL Certificate) by checking it and clicking Enroll.
          \n          \"Enroll\"<\/a><\/strong><\/li>\n
        12. Click Finish<\/strong> and close all of the open windows.<\/li>\n<\/ol>\n<\/ol>\n
          \n

           <\/p>\n

          The next task will be to configure ADFS<\/h3>\n
            \n
          1. Open up ADFS management (Start > Administrative tools > AD FS 2.0 Management)<\/li>\n
          2. On the ADFS 2.0 management window, click ADFS 2.0 Federation Server Configuration Wizard<\/strong>\"Wizard\"<\/a><\/li>\n
          3. Leave the default of Create a new Federation Service<\/strong> selected and click Next<\/strong><\/li>\n
          4. On the Select Deployment Type<\/strong> page, select Stand-alone federation server and click Next<\/strong><\/li>\n
          5. Make sure your SSL certificate is selected on the Federation Service Name<\/strong> page and click Next<\/strong><\/li>\n
          6. Click Next<\/strong> on the summary screen and wait for the wizard to complete.<\/li>\n
          7. One the wizard is finished, click Close<\/strong>. Now ADFS is installed and ready to be used.<\/li>\n<\/ol>\n

             <\/p>\n","protected":false},"excerpt":{"rendered":"

            Note: This guide assumes you have a Windows server, it is joined to a domain and you have an account that is part of the domain admins group.   First we need to install ADFS 2.0 To install version 2.0, it first needs to be downloaded and installed. Click this link to download the installation…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[101,20,3,67,4,54,6],"tags":[108,96,102,107,111,109,110,118,105,106,103,13,113,5,114,112,45,104,115,93],"class_list":["post-406","post","type-post","status-publish","format-standard","hentry","category-adfs","category-blog","category-information-technology","category-microsoft","category-servers","category-software","category-windows","tag-2-0","tag-active-directory","tag-adfs","tag-certificate","tag-encryption","tag-federation-service","tag-federation-services","tag-microsoft","tag-role","tag-roles","tag-saml","tag-server","tag-server-2008","tag-server-2008-r2","tag-servers","tag-service","tag-ssl","tag-sso","tag-windows","tag-windows-server"],"_links":{"self":[{"href":"https:\/\/jackhanington.com\/blog\/wp-json\/wp\/v2\/posts\/406","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jackhanington.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jackhanington.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jackhanington.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jackhanington.com\/blog\/wp-json\/wp\/v2\/comments?post=406"}],"version-history":[{"count":2,"href":"https:\/\/jackhanington.com\/blog\/wp-json\/wp\/v2\/posts\/406\/revisions"}],"predecessor-version":[{"id":420,"href":"https:\/\/jackhanington.com\/blog\/wp-json\/wp\/v2\/posts\/406\/revisions\/420"}],"wp:attachment":[{"href":"https:\/\/jackhanington.com\/blog\/wp-json\/wp\/v2\/media?parent=406"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jackhanington.com\/blog\/wp-json\/wp\/v2\/categories?post=406"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jackhanington.com\/blog\/wp-json\/wp\/v2\/tags?post=406"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}