SSO Integration using ADFS

[kennysarmy]

In order for our new Library System to utilize single sign on I need to setup ADFS on my network.

 

We're running Windows 2012 R2 Domain Controllers and Servers and the clients are a mixture of Windows 10 and Windows 7.

 

 

Does anyone have any good notes for getting ADFS working? Any gotchas?

[epoch_roots]

ADFS is no joke and without proper resiliency built in it could cause more headaches than it can solve, especially if you plan on using it to provide access to services when users are connecting from outside your network. I'd imagine SQL Server licensing wouldn't be cheap either.

Azure AD connect / seamless sso is a much better option when resources are limited, especially if you're already in the Office365 /Windows ecosystem.

[kennysarmy]

ADFS is no joke and without proper resiliency built in it could cause more headaches than it can solve, especially if you plan on using it to provide access to services when users are connecting from outside your network. I'd imagine SQL Server licensing wouldn't be cheap either.

Azure AD connect / seamless sso is a much better option when resources are limited, especially if you're already in the Office365 /Windows ecosystem.

 

I don't think it's for accessing from out to in - it's to allow our students to access the new library system which is going to be hosted off site.

 

When I go through the ADFS setup on one of the DC's I get as far as this...

 

 

The big highlighted in red is confusing me - can anyone translate in to English please?

[HPlum78]

the AD FS service is what your internal clients will connect to and what that is saying is that you cannot have the proxy service installed on the same server (the WAP proxy service for AD FS is essentially what your external clients would connect to)

 

This is the reason your are seeing that error you have highlighted above:-

 

 

Here is the best practise guide:-

 

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs

Edited May 22, 2018 by HPlum78

[kennysarmy]

the AD FS service is what your internal clients will connect to and what that is saying is that you cannot have the proxy service installed on the same server (the WAP proxy service for AD FS is essentially what your external clients would connect to)

 

This is the reason your are seeing that error you have highlighted above:-

[ATTACH=CONFIG]49047[/ATTACH]

 

 

Here is the best practise guide:-

 

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs

 

So I need to install ADFS on one of my DC's and the WAP proxy service on the other?

 

I'm also reading up about certificates that are required....just emailed AccessIT library support to see if they provide that certificate....

[HPlum78]

So you should probably set up a server just for the WAP service to sit on, or at least that's what I would recommend and that's if you are going to allow access to your application from outside of your network. You will need a Service communications cert if you are going to allow access to your services from outside of your org you will need to get yourself an EV cert from your cert supplier. Edited May 22, 2018 by HPlum78
typeing with my face!

[kennysarmy]

So you should probably set up a server just for the WAP service to sit on, or at least that's what I would recommend and that's if you are going to allow access to your application from outside of your network. You will need a Service communications cert if you are going to allow access to your services from outside of your org you will need to get yourself an EV cert from your cert supplier.

 

AFAIK we're not allowing access to any services inside our network, it's purely to allow users on the domain to authenticate against a cloud library system against our AD (apparently that's what installing ADFS will allow) and when the students are at home they will access the cloud based library system and again authenticate against our AD....

 

I'm just disappointed that the cloud library software firm is basically saying you need ADFS to allow our software to work, but we can't help you with it!

[KevinB]

I'm just disappointed that the cloud library software firm is basically saying you need ADFS to allow our software to work, but we can't help you with it!

 

I would be too. We've got a couple of offsite services that use AD integration and they just do an ldaps lookup. I'd be horrified if I had to set up ADFS just for a library system. Just out of interest, who is it, so that I can make sure we never get it?

[kennysarmy]

AccessIT !

 

https://accessitlibrary.com/

[KevinB]

Ta My blacklist is short, but it just got a +1.

[HPlum78]

LDAPS is not what I would recommend I have just worked really hard to get shot of LDAP proxies. In fact AD FS is now a requirement for new applications (on prem/ cloud based) as LDAP(s) is just not an application authentication method that we are willing to support!. I don't understand why AD FS is such a massive issue out there? I have the thick wedge of 50 services authenticating via AD FS and if you see my other post from today you will see the use of the AD FS environment. On that note we are also trying to move towards using Azure for Seamless SSO but as I have said in another post recently its just not quite there around the authorization piece just yet.

 

I would blacklist any app that could only do authentication by LDAP(s)!

[KevinB]

With that many services, ADFS is obviously a sensible option, but for just a library service and maybe a couple of others it's overkill imho.

[kennysarmy]

LDAPS is not what I would recommend I have just worked really hard to get shot of LDAP proxies. In fact AD FS is now a requirement for new applications (on prem/ cloud based) as LDAP(s) is just not an application authentication method that we are willing to support!. I don't understand why AD FS is such a massive issue out there? I have the thick wedge of 50 services authenticating via AD FS and if you see my other post from today you will see the use of the AD FS environment. On that note we are also trying to move towards using Azure for Seamless SSO but as I have said in another post recently its just not quite there around the authorization piece just yet.

 

I would blacklist any app that could only do authentication by LDAP(s)!

 

I guess it's a massive issue as to me it looks very complicated to install and setup having never done it before, not understanding the implications of what I might f**k up if I do it wrong on my DC's!

 

Might just have to have a go and take a snapshot of the servers before I start.

[HPlum78]

Can you only install AD FS on your DC's? being installed on a DC is not a requirement for AD FS.

 

- - - Updated - - -

 

you could just use your LDAP proxy boxes (as ADFS servers)

Edited May 22, 2018 by HPlum78

[chazzy2501]

I would NOT go down the ADFS route without proper planning and budget. I think for most schools it's total overkill. Maybe you can use RM Connect. Are you sure Federated services is the only method? Should have brought that up before purchasing this new Library service.

[chazzy2501]

I would NOT go down the ADFS route without proper planning and budget. I think for most schools it's total overkill. Maybe you can use RM Connect. Are you sure Federated services is the only method? Should have brought that up before purchasing this new Library service.

[kennysarmy]

I would NOT go down the ADFS route without proper planning and budget. I think for most schools it's total overkill. Maybe you can use RM Connect. Are you sure Federated services is the only method? Should have brought that up before purchasing this new Library service.

 

No it's not the only option, but the other single sign on methods rely on things we don't have:

 

If you're using Google Applications or Office 365 and already have access to Google's G-Suite or Microsoft Azure, such integration would be the easiest to configure and use.

 

We think for simplicity at this stage we might just get them to extract the users from AD and use a separate (changeable) password which they manage, users could change this to match their AD one if they want.

 

OK, we'd not have single sign on, but it's a lot less hassle for us, as we have no budget to put against this and no training available....

[HPlum78]

And then you are setting out the behaviour that should be avoided at all costs. You best hope that the company that is being slated so much for offering modern auth methods don't have any rouge employees now that they own all of your usernames and passwords..... that is a really bad idea.

 

I am not going to get involved in a massive conversation around authentication methods and the merits of each, from a security stand point claims/ token based is the way forward no matter what the scale of your individual organisations are. And if any of you are using LDAP(s) I hope that this is not directly to your DC's as that would be worse than spending time moving to AD FS (or at least have LDAP proxies).

Edited May 22, 2018 by HPlum78

[KevinB]

No it's not the only option, but the other single sign on methods rely on things we don't have:

 

If you're using Google Applications or Office 365 and already have access to Google's G-Suite or Microsoft Azure, such integration would be the easiest to configure and use.

 

We think for simplicity at this stage we might just get them to extract the users from AD and use a separate (changeable) password which they manage, users could change this to match their AD one if they want.

 

OK, we'd not have single sign on, but it's a lot less hassle for us, as we have no budget to put against this and no training available....

 

Since you mention Azure, do you know that there's a free version of that for education? And Azure AD sync is very simple to set up. See here for more info.