Prepare to Install ADFS 2.1 Services to have SingleSignOn (SSO) in Windows Intune (WaveD) – Part 1

1:42 pm in ADFS, best practices, con, ConfigMgr 2012 SP1, intune, scc, SCCM 2012 SP1, Windows Intune by Kenny Buntinx [MVP]

 

With the SP1 release of System Center 2012 Configuration Manager, we now have the ability to connect to Windows Intune to manage mobile devices via the Internet. This allows you to use the Configuration Manager console to provision mobile devices, apply policy, and target apps to mobile devices even when those devices are not connected to the corporate network.

To provide users with an integrated sign-on experience (and reduce the need for administrators to manage two passwords for users) it is highly recommended that you deploy ADFS. ADFS provides the capability for a cloud server to leverage on-premise Active Directory credentials.

To deploy and configure ADFS 2.1 (server 2012) , follow the steps outlined below. This blog will cover the configuration and deployment work needed to successfully connect their device with corporate credentials . Before you install ADFS 2.1 on Windows Server 2012, you have to think through some of the requirements.

The benefits of implementing ADFS:

  • Improves user productivity by enabling true single sign-on to domain joined computers
  • Reduces usability issues by allowing users to use AD credentials to access all “Windows Intune" or “Office 365” services and not have to remember two identities and two passwords
  • Allows administrators the ability to enforce the organization’s password policies and account restrictions in both the on-premises and cloud-based organizations
  • Increases security of AD credentials since passwords are never synced to the cloud, all authentication happens on-premises
  • Reduces overall administration time and costs associated due to the above points

Based on a lot of TechNet articles , this was my design :

image

 

  • Will feature two ADFS farm servers (For redundancy reasons)
  • Will have two ADFS proxy servers (For redundancy reasons)
  • Will have one DirSync server (separate VM for preformance)
  • Will use a HW load balancer (Cisco , F5 , Citrix Netscaler) instead of Microsoft multicast NLB ( It doesn’t really work that well – or call it bad experiences) on both ADFS farm and ADFS proxy servers
  • Due to the size of the environment (Less than 50,000), WID (Windows Internal Database) server will have to be used
  • This WID SQL server will be running SQL Express edition.

In addition, we need to determine a few things upfront, as it will speed up the installation work. My personal experience is that you really need one of the internal Network guys from the customer to make this happen. We as “configmgr” guy’s are not familiar on how a customers network is organized and who is responsible for what part of the network)

  • External IP address of the federation service (In my example 212.x.x.x)
  • DMZ IP address of the federation service (which will be assigned to NLB as a shared virtual IP address , in my example 192.168.x.20)
  • DMZ server dedicated IP addresses (In my example 192.168.x.1 and 192.168.x.2) , they also reside in workgroup (not domain joined)
  • Internal ADFS farm shared virtual IP address assigned to the ADFS farm NLB (in my example 10.x.x.20)
  • Internal ADFS server dedicated IP addresses (in my example 10.x.x.1 and 10.x.x.2)
  • Fully qualified DNS name of the federation service, or ADFS FQDN (in my example Federation.SCUG.be) 
  • Service accounts used for various purposes in the setup
  • Public SSL certificate to secure traffic associated with ADFS. Certificates used for server authentication and token signing. Try to order a *.<yourdomainname> certificate.This will make your life much easier. (in my example *.SCUG.be) 
  • Necessary firewall ports are open from the Internet to ADFS Proxy server (port 443)
  • Necessary firewall ports are open from ADFS Proxy server to internal ADFS server (port 443)
  • Necessary firewall ports are open from the Internet to Dirsync server and visa versa (port 443)

This brings us to the end of this post. In the next few posts, we’ll cover additional configuration and installation steps and bring this Windows Intune SSO / ADFS 2.1 infrastructure on Windows Server 2012 to a usable state.

Stay Tuned !

 

Hope it Helps ,

Kenny Buntinx

Enterprise Client MVP