AD FS Configuring a Relying Party Trust
This video will look at creating a relying party trust in Active Directory Federation Services. A relying party trust is required in order to create claims that will be used by the resource partner.
Access the rest of the course http://ITFreeTraining.com/federation
Download the PDF handout http://ITFreeTraining.com/handouts/fe...
In this video
This video will create a relying party trust in the ITFreeTraining domain. In the previous videos Active Directory Federation Services and Active Directory Certificate Services were installed. In this video, an Enterprise CA was created which issued a certificate to the Active Directory Federation Server in the ITFreeTraining domain. In the HighCostTraining domain, a standalone certificate service was installed on the same server as the Active Directory Federation Service was installed on. In the previous videos, both servers had Active Directory Federation Services installed and configured. Both networks also have a Domain Controller. The Relying party trust that will be created in the ITFreeTraining domain is essentially the configuration that is created on the ITFreeTraining Active Directory Federation Server. This configuration determines how a claim will be created on that server that will be used in the HighCostTraining domain. For this reason, the relying party trust requires information from the server in order to determine what it expects.
Demonstration of creating a relying party trust
1) Open server manager and from Server Manager select the tools menu and then select the option for "AD FS Management".
2) From AD FS Management, expand down through "Trust Relationship". Right click "Relying Party Trusts" and select the option "Add Relying Party Trust" to start the wizard.
3) Once past the welcome screen, the next screen will ask for information about the other server. The simplest way to obtain this information is to have that server contact the other server to obtain the information. The information can also be exported to a file and imported. As a last resort, the administrator is able to manually enter in this information.
4) The information obtained from the other server is obtained from an XML file. If you expand service and then look in the container EndPoints, under Metadata you will find the information about the server. If you want to export this data, open it in Internet Explorer and save it to a file. This can then be imported in the other server.
5) If you use the option to contact the other server directly to obtain the required information the other server will need to be resolvable. If it is in another company, you can configure DNS forwarding which was done in this video. You could also use the IP Address to connect to the other server.
6) If you obtain an error stating that a secure channel could not be created between the two servers, you will need to export and import the certificate as explained below. In this case the relying party trust is being created and thus HighCostTraining needs the certificate import. In this case both certificates are imported, as in the later video the claims provider trust is created and HighCostTraining needs access to ITFreeTraining in order to do this.
7) On the "Specify Display Name" screen, enter in a meaningful display name so other administrators know what the trust was created for. You also have the option to enter in additional notes about the trust.
8) The wizard gives you the option to configure multi-factor authentication. In this case, the option to do this was not selected.
9) The "Choose Issuance Authorization Rules" determines the default permissions for the trust. The trust can either be by default "allow access" or access can be denied. For better security it is best to deny access, however that will mean that the administrator will have to specify who can use the trust, otherwise the trust cannot be used.
10) The "Ready to add trust" screen will show all the information about the trust. Once next is pressed, the trust will be created.
11) The last screen of the wizard will give you the option to edit the trust after it is created. If you clear this option, the administrator can edit the trust later on.
Description to long for YouTube. Please see the following link for the rest of the description.
http://itfreetraining.com/federation#...
References
"AD FS 2.0 Step-by-Step and How To Guides" http://technet.microsoft.com/en-us/li...