ADFS 2.0 Certificates

ubern00b

ubern00b

ubern00b

Soldato
Joined
25 Nov 2004
Posts
3,792
Hi All

I have been tasked with designing and implementing ADFS 2.0 in our organisation. This will be a one way authentication mechanism from a 3rd party web application to authenticate with our active directory.

What I need to understand is how certificates play a part in this. We have a root/intermediate CA for domain.local which we want to use for ADFS however we are unsure if a local domain certificate will create problems on the permiter/internet side of things. We present an ADFS login via a proxy server in the DMZ which will be accessible from a real domain and have the necessary certificate. The ADFS proxy then relays the information back to the internal ADFS server which will be using the local domain certificate. Will this cause issues?

Could be a simple case of putting an intermediate CA in the DMZ for the proxy to certify with? Does ADFS "bind" to the hostname you present out to the wild in any way?

Thanks for your help, hope this post is coherent :)
 
From memory, the certificates used by ADFS are two-fold:

1) To secure the IIS installation where ADFS is running
2) To sign (and verify) the tokens passed via cookies from the Resource website

The certs need to be trusted by:

1) The PCs inside your network that access the ADFS-enabled website
2) Your domain controllers
3) Your ADFS instance
4) The "Resource" website (i.e. the external website you are setting up ADFS for).

1, 2, 3 are satisfied by your CA, and 4 is satisfied when you send your public key to the Resource website sysadmin (who has to install it at his/her end).

I may have forgotten something, but that's roughly the gist.

No firewall rules are needed as everything is done through browser re-directs. The provider of the web service should be able to offer at least some basic guidance -- they are presumably following SAML and will require you to configure a few things in a specific way.

This guide is specific to Webex, but gives a good general idea of the process. Just use your CA certs rather than self-signed ones. It's fiddly to get the parameters correct, but otherwise relatively straightforward to setup.

https://support.webex.com/MyAccount...oot=Tools&parent=Knowledge&articleId=WBX63102
 
PS. Although you technically can, don't use the same cert for both IIS and token signing. It is not recommended (can't remember why).
 
You must log in or register to reply here.
Back
Top Bottom