| Installing and configuring AD FS |  |
| This section describes how to install and configure Active Directory Federation Services (AD FS) 2.0. Prerequisites Infrastructure Microsoft Active Directory must be available. Prerequisites for the AD FS server The server on which AD FS is installed must meet these prerequisites: 64-bit Windows Server 2008 R2 operating system. Internet connection for installing software from Microsoft. The AD FS server must be part of the same Windows domain as the client PCs. All available ‘important’ Windows updates must have been installed. Some steps in this section automatically install additional Microsoft software. In case of problems, check for updates for this additional software as well. Internet Information Services (IIS) 7 See Installing IIS. An SSL certificate trusted by browsers of clients must be available. See Adding IIS binding for HTTPS. The site 'Default Web Site' is available and has an http and https binding. The ports used for these bindings may differ from the default ports 80 and 443. The AD FS installer must be present. You can download this installer from the AD FS download site: `http://www.microsoft.com/downloads/en/details.aspx?FamilyID=118c3588-9070-426a-b655-6cec0a92c10b&displaylang=en`. You must download version 2.0 RTW, variant `RTW\W2K8-R2\amd64\AdfsSetup.exe`. By default ADFS uses TCP/IP port 1500 and 1501. Ensure these ports are not occupied by other processes. Run this command: `netstat -ano | findgrep 0.0.0.0:1501`. .NET Framework 4.0 must be installed. You can download .Net from this site: `http://msdn.microsoft.com/en-us/netframework/aa569263.aspx` Prerequisites for the client PC To have a true SSO experience: The client must be part of the same Windows domain as the AD FS server. The browser must have ‘integrated authentication’ turned on. In Internet Explorer this option is selected by default Installing IIS To install IIS: In Server Manager, switch on the Web Server (IIS) role, with the default role services, and additionally these services: ASP.NET and dependent role services Logging Tools Tracing Basic Authentication Windows Authentication Ensure .NET Framework 4 is installed. You can download this software from `http://www.microsoft.com/net/`, or install it using the Web Platform Installer. Sometimes .Net Framework requires a repair action. To perform this action: Start a Windows PowerShell. You must run the shell as administrator. Type this command: `cd C:\Windows\Microsoft.NET\Framework64\v4.0.30319` Type this command: `.\aspnet_regiis.exe -ir` Result This output is displayed in the PowerShell window:
    Start installing ASP.NET (4.0.30319) without changing existing web applications
    to use this version of ASP.Net.
    .........
    Finished installing ASP.NET (4.0.30319) without changing existing web applications to use
    this version of ASP.Net.
After the installation, IIS has a Default Web Site. Important! AD FS 2.0 should not be installed into a web site that has, or will have, Sharepoint installed into it. Sharepoint must always be installed into a separate site. Adding IIS binding for HTTPS Before starting the installation of AD FS as a web application in IIS, you must give the IIS Default Web Site an https binding with the corresponding certificate. If no SSL certificate is available yet on IIS, create a self-signed certificate for now. Later you can replace this certificate with a CA-signed certificate. Creating a CA-signed certificate To create a CA-signed certificate: In the IIS Manager snap-in, select the server node that represents the AD FS server. In the Features view, open Server Certificates. Click Create Certificate Request. In the Distinguished Name Properties window, specify this information and click Next. Common Name Specify the Full Qualified Host Name of the AD FS server. Ensure you specify this name correctly. For example: `adfshost.mycompany.com` The information specified in the following fields is important from an organizational perspective, but does not affect a proper functioning of the software. Organization Specify the name of your organization. Organizational unit City/location State/province Country/region In the Cryptographic Service Provider Properties Window, specify this information and click Next. Cryptographic service provider Select the "Microsoft RSA Channel Cryptographic Provider". Bit Length Specify 2048. Note: AD FS requires at least 2048 bits. In the File Name window, save the request to a txt-file. Submit the certificate request at the certificate authority of your choice and save the response to a file. Back in the Server Certificates screen in the IIS Manager snap-in, complete these steps: Click Complete Certificate Request... Specify the name of the response file. For example, “Default Web Site on [ADFS Server name]”. Click OK. Write down the certificate name, because you may need this name in the future. After some time you should see a new certificate in the Server Certificates table. Complete these steps: In the IIS Manager snap-in, select the Default Web Site and click Bindings to display the Site Bindings dialog. Add a binding for 'https', with IP address “All Unassigned” and Port 443. Then select the just-created certificate. Changing the http and https ports of the Default Web Site If you plan to install Infor Companion and SharePoint at the same AD FS Server, the ports for the http and https service must not be set to the default value. Note If you change these ports later, you must re-install AD FS. Infor recommends changing the http port to 9680 and the https port to 9643. To change the http and https ports of the Default Web Site: Open the IIS Manager snap-in. In the Connections pane, select the Default Web Site. In the Actions pane, click Bindings to open the Site Bindings window. In the Site Bindings window, edit the http type. Change the port to 9680 or another unique port. In the Site Bindings window, edit the https type. Change the port to 9643 or another unique port. Installing AD FS 2.0 To install AD FS 2.0: Download the AD FS installer. You can download this installer from the AD FS download site: `http://www.microsoft.com/downloads/en/details.aspx?FamilyID=118c3588-9070-426a-b655-6cec0a92c10b&displaylang=en`. You must download version 2.0 RTW, variant `RTW\W2K8-R2\amd64\AdfsSetup.exe`. Start the installer. Click Next in the Welcome page and accept the End-User License Agreement. In the Server Role page, select Federation server. Do not select a Federation server proxy. Click Next to start the installation. The installation should take 5 minutes at most. When the installation is finished, the Completed the AD FS 2.0 Setup Wizard page is displayed. Select Start the AD FS 2.0 Management snap-in when this wizard closes and click Finish. The AD FS 2.0 Management MMC snap-in is installed. The snap-in starts automatically. The next section continues from this point. Note If you use a ‘favorites’ MMC console, it is useful to add the AD FS 2.0 Management snap-in to it. Configuring AD FS 2.0 To configure AD FS 2.0 and install its web application: Starting from the root node of the AD FS 2.0 MMC snap-in, start the AD FS 2.0 Federation Server Configuration Wizard. In the wizard, make these choices: Select Create a new Federation Service. Select Stand-alone federation server. Select a HTTPS binding. At this point, the AD FS installer finds all HTTPS bindings for the Default Web Site. You must select one of these bindings. In the scenario in this section, there is only one HTTPS binding. Therefore no choice is offered. No other choices can be made. The actual configuration step takes less than 5 minutes. Most time is spent during "Install Windows Internal Database". Result The "AD FS 2.0" MMC snap-in now shows the "Required Configuration Incomplete" option, with the “Required: Add a trusted relying party” task. The "AD FS 2.0" MMC snap-in now shows sub-nodes, for example for trusts and stores. Browsing on the client PC to `https://[AD FS Server].[Windows domain].com/adfs/services/trust/mex` returns a WSDL <definitions> XML document. No certificate error occurs, because the HTTPS certificate is CA-signed and its root certificate is trusted by the browser. See: Adding IIS binding for HTTPS The prerequisites for the client PC in the Prerequisites section. Now the AD FS 2.0 configuration is working, but no relying party trusts are defined yet. The creation of relying party trusts will take place during the installation of products that make use of AD FS. |