Welcome to this course on Identity Federation and Access Control in Windows Server 2019.
The focus of this course is on Active Directory Federation Services, which has a role in Windows Server
2019 and a technology that's existed for several versions of Windows Server.
ADF's allows you to authenticate and authorise users to access applications that you host and also allows
users to access applications hosted by other organisations that you federated with and they can do that
using their credentials within your organisation.
ADF's allows you to set up trust relationships to allow users to authenticate across security boundaries.
Think of an application hosted on a server as a trust boundary.
It could have its own authentication mechanism, like storing user information in a database and verifying
a user's identity when they log in with the username and password stored in that database.
For applications hosted within the corporate network, you can leverage Kerberos authentication to pick
up the user's identity from the network.
But you still need to make authorization decisions based on attributes of the user.
Typically, roles that are either stored in Active Directory or within the application itself and linked
to your user identities.
Even though Windows integrated authentication brings convenience when it comes to the authentication
mechanism, it's obviously limited to Internet applications, and your application is coupled to that
specific authentication method.
What ADF's does is decouple authentication mechanisms from applications so you can change the authentication
method from Windows integrated to more robust authentication mechanisms like Certificates or Azure MFA
or Windows.
Hello for business and the application itself isn't affected.
You can also require a second factor of authentication in order for users to access applications and
no changes to the application itself are required.
And using a special feature of ADF's called Web Application Proxy, you can publish applications to
the extra net or Internet and specify a different set of authentication credentials for users coming
from outside your network.
ADF's also allows for authorising who can access the applications.
It lets you make those authorisation decisions based on granular attributes about the user called claims
rather than relying solely on roles.
And you can send those claims back to the application to make further decisions.
All this serves to speed up development time because applications don't need to have their own individual
authentication and authorization subsystems because those services are decoupled from the application.
You have more flexibility in how you implement them and the authentication methods that you choose.
Centralizing identity management and access control reduces the pain related to provisioning and provisioning
users.
And ADF's uses open standards so it can provide authentication and authorisation not only for custom
built applications but for any commercial off the shelf solution that supports those standards.
Now I've mentioned that you can use a component of DFS to publish applications to the Internet.
That technology is called Web Application Proxy.
It allows you to pre authenticate users coming from the internet before accessing internal applications.
And you can specify that those users provide one set of authentication credentials and users on your
intranet provide a different set.
Maybe you want users on the Internet to use multifactor authentication, for example.
Typically, ADF's is used with claims based applications and we'll be going into a lot of detail later
in the course on claims and how they're used.
But address can also be used with web application proxy to authenticate users to applications that use
Windows integrated authentication so you can publish those applications outside your corporate network.
ADF's will require the user to log in with forms based authentication and then it will return a Kerberos
ticket to authenticate the users to the application.
I'll be showing you that later in the course.
So just for applications hosted within your network, there's a pretty good value proposition for using
DFS, especially since it's already part of Windows Server.
But where it really shines is by federating a user's identity across organisational boundaries using
standard protocols.
You can set up a trust relationship with another organisation.
So when your users try to access applications hosted by that organisation, they can get redirected
to the partner's identity server which redirects them to your ADF's server to log in with their own
credentials.
Then standard claims can be returned to the other organisation to be used to identify the user and to
make further authorisation decisions.
I'll be showing you how to set this up later in the course.
This opens up a lot of possibilities not only for federating with other organisations, but for allowing
users to access web based applications like Salesforce or ArcGIS online or office.
365.
When you set up trust relationships with those software as a service solutions, users don't need to
have a separate set of credentials, which makes life a lot easier for end users.
For organizations moving to the cloud, there's often a concern about identity management and security.
Organizations may not want to store user passwords in the cloud for security or compliance reasons.
ADF's isn't the only solution for integrating with Microsoft Azure.
But it is a very flexible one that allows you to leverage on premises authentication.
So user accounts are sync to the cloud, but user passwords are stored on premises inactive directory.
And you can leverage all of the benefits of DFS in terms of the authentication, methods, features
and the control that it offers.
When users access resources in Azure, they get redirected to your ADF's server that's exposed to the
Internet using web application proxy and they authenticate with a DFS before being allowed access to
your resources in the cloud.
I'll be showing you how to set this up later in the course too.
ADF's has really evolved through the different versions.
And it's part of Microsoft's overall strategy to protect a user's password and even eliminate the need
for passwords altogether.
Passwords have issues.
They can be obtained by nefarious actors through hacking and social engineering, and users tend to
use the same password across many different applications.
So not only does that increase the risk of a password being stolen, it also increases the damage that
can be done when it is stolen.
Later in the course, you're going to see all the different authentication methods that ADF can provide
from Windows authentication in forms based authentication to certificate authentication, device authentication
and Windows Hello for business, which lets the user authenticate using their device and a gesture like
a fingerprint or facial recognition.
You'll see how Azure multifactor authentication can be used as a second factor of authentication after
one of the other methods and the user can be sent a text message to enter into the browser.
Or they could receive a phone call or a push notification to an app on their phone to complete authentication.
Azure MFA can also be used as the primary authentication method, so users don't need to enter a password
at all and you can integrate other non Microsoft MFA providers with ADF.
Also, user identity information is typically stored in Active Directory, but you can configure ADF
first to authenticate users against any LDAP compliant directory.
You typically retrieve the user attributes from the identity store, but it's possible to configure
additional attributes stores also even when using Active Directory as the identity store, user attributes
can be retrieved from other sources like an LDAP directory or Microsoft SQL Server.
You'll see that later in the course too.
So we've talked about the benefits of using Active Directory Federation services and the value that
it can bring for users and for I.T in the rest of the module.
You'll learn about some of the new features in Free 2019 will discuss the lab environment for the VMs
I'll be using in the demos so you can set up your own.
Then I'll explain the certificates used by EDF's and we'll create an SSL certificate that the ADF service
will use.
Then we'll install and configure ADF's in a Windows Server 2019 environment.
After that you'll learn about upgrading ADF's from ADF's 2016 and it's also supported to upgrade directly
from ADF in Windows Server 2012 or to then I'll show you the new ADF RFS Help website, which is a resource
Microsoft provides for troubleshooting ADF's problems.
And finally, you'll see a couple of the tools that you can get from that website, the ADF's Diagnostics
Analyzer and the ADF's Rapid Restore tool for backing up and restoring a single serve or ADF, for instance.
So next, let's talk about some of the new features in ADF's 2019.