A, ADFS installation tutorial
Precautions:
1, ADFS dependent domain environment, i.e., Active Directory Domain Services (AD DS) , ADDS will also install the DNS service. ADDS ADFS and do not install to the same server, manage and maintain their convenient! In addition the use of the domain name standard format domain name , such as "mycompany.com", do not use "mycompany.local", because the public can not apply for an SSL certificate.
2, ADFS server where the need to join a domain! ADFS otherwise unable to communicate with AD.
3, you must use an SSL certificate, and a certificate for the public, or external network access has trust issues! Certificates can be used pan-domain certificates, such as "* .mycompany.com", then ADFS service name (Federation Service Name) can be defined as adfs.mycompany.com or sso.mycompany.com and so on, and the sub-domain name can be resolved correctly ( intranet DNS to resolve configuration). If you use the "sso.mycompany.com" sub-domain SSL certificates, ADFS service name (Federation Service Name) must be consistent, that is, "sso.mycompany.com"!
4, after the installation and configuration is completed, the network test (because it is the network DNS) https://sso.mycompany.com/adfs/ls/idpinitiatedSignOn.aspx
If you can not access, use powershell,
- Check whether to enable
_>(Get-AdfsProperties).EnableIdPInitiatedSignonPage
If it returns "false", be enabled
_>Set-AdfsProperties -EnableIdPInitiatedSignonPage $true
Guide link (installation and configuration comprises two steps):
https://www.virtuallyboring.com/how-to-setup-microsoft-active-directory-federation-services-adfs/
Two, ADFS Proxy (Web Application Proxy) Installation Guide
ADFS located in the network, usually for safety reasons, is not disclosed for client access to the external network, typically carried out indirectly through ADFS agent.
Precautions:
1, ADFS and agents not deployed to the same server!
2, agents do not add domain! But the need to be able to access ADFS server!
3, and ADFS can use the same certificate!
4, because it is the SSL communication, the need for domain names! Configuring the external network DNS pointing to this server (sample domain https://sso.mycompany.com)
Tutorial link (containing the agent installation, configuration, release three steps)
5, after the release is completed, Extranet test (non-corporate network, then access a proxy server)
https://sso.mycompany.com/adfs/ls/idpinitiatedSignOn.aspx