|By Matt Hester||
|November 3, 2013 06:00 PM EST||
In Kevin Remde's post this week he talked about many new features for Windows Server 2012 R2 Active directory. You can find his great post here: What’s New for Active Directory in Server 2012 R2. One of the new functionalities he mentioned was Workplace Join. Workplace join allows you to deal with the explosion of devices (Windows and Non-Windows (like iOS) connecting to your organization. This has you constantly trying to maintain your organizations compliance and security. Especially with users located all around the world across multiple platforms and devices this is a challenge.
If this sounds like you currently or is soon going to be you then you will want to check out Workplace join. Workplace join allows users to register devices (including IOS) for single sign-on and access to corporate data. In today’s article I am going to take a look at how to set this feature up step by step.
This feature does require Windows Server 2012 R2, and you will need to configure Active Directory and Active Directory Federation Services to make this work. Additionally you will need to create an Enterprise Certificate Authority for the certificates you will need for this service to work properly. Overall the process is straight forward, but you will need to make sure you dot all your I’s and cross your T’s. For my environment, I created 4 separate virtual machines to test this out. I created an AD DC, AD FS server, a Web Server (for testing) and a Windows 8,1 client. The full configuration and the test application for this configuration can be found here, it is an excellent article: Set up the lab environment for AD FS in Windows Server 2012 R2
Configure the Domain Controller
On the DC you will need to make a Globally Managed Service Account (GMSA). The GMSA account is required during the AD FS installation and configuration.
- Open a PowerShell command window and type:
Add-KdsRootKey –EffectiveTime (Get-Date).AddHours(-10)
New-ADServiceAccount FsGmsa -DNSHostName adfs1.contoso.com -ServicePrincipalNames http/adfs1.contoso.com
Note: This command is for a domain name contoso.com and if your ADFS server is named adfs1.
Configure Your Certificate
When you configure your domain controller you will also want to add and configure the certificate authority services. Here is a great article for this process here: Configure SSL/TLS on a Web site in the domain with an Enterprise CA. However, when you create the certificate you will want to allow for…Also check John’s video out below for a little more detail on how the certificates work. This is also something you want to make sure you follow closely.
Configure Active Directory Federation Services
On the AD FS server you will need to enroll the certificate from the article above on configuring your Enterprise CA. When you bring the cert in you will want to make sure you configure it with the follow attributes
- Subject Name (CN): adfs1.contoso.com
- Subject Alternative Name (DNS): adfs1.contoso.com
- Subject Alternative Name (DNS): enterpriseregistration.contoso.com
After you have configure your certificate you need to add the ADFS role
- Log onto the server using the domain administrator account ([email protected]).
- Open Server Manager. To do this, click Server Manager on the Start screen, or Server Manager in the taskbar on the desktop. In the Quick Start tab of the Welcome tile on the Dashboard page, click Add roles and features. Alternatively, you can click Add Roles and Features on the Manage menu.
- On the Before you begin page, click Next.
- On the Select installation type page, click Role-based or feature-based installation, and click Next.
- On the Select destination server page, click Select a server from the server pool, verify that the target computer is highlighted, and then click Next.
- On the Select server roles page, click Active Directory Federation Services, and then click Next.
- On the Select features page, click Next.
- On the Active Directory Federation Service (AD FS) page, click Next.
- After you verify the information on the Confirm installation selections page, select the Restart the destination server automatically if required check box, and then click Install.
- On the Installation progress page, verify that everything installed correctly, and then click Close.
After the role is installed you will need to configure the service. On the Server Manager Dashboard page, click the Notifications flag, and then click Configure the federation service on the server This is for a domain name confoso,com and an ADFS server named adfs1.
- The Active Directory Federation Service Configuration Wizard is launched.1.On the Welcome page, select Create the first federation server in a federation server farm and click Next.
- On the Connect to AD DS page, specify an account with domain administrator permissions for the contoso.com AD domain that this computer is joined to and then click Next.
- On the Specify Service Properties page, do the following and then click Next:
- Import the SSL certificate that you have obtained earlier. This is the required service authentication certificate. Browse to the location of your SSL certificate.
- Provide a name for your federation service, type adfs1.contoso.com. This is the same value you provided when enrolling an SSL certificated in AD CS.
- Provide a display name for your federation service, type, Contoso Corporation.
- On the Specify Service Account page, select Use an existing domain user account or group Managed Service Account and then specify the GMSA account (fsgmsa) you created when setting up the domain controller.
- On the Specify Configuration Database page, select Create a database on this server using Windows Internal Database and then click Next.
- On the Review Options page, verify your configuration selections and click Next.
- On the Pre-requisite Checks page, verify that all pre-requisite checks were successfully completed, and then click Configure.
- On the Results page, review the results and whether the configuration has completed successfully, and then click Next steps required for completing your federation service deployment.
You will also need to run some PowerShell commands and configurations to finish the ADFS configuration. In a PowerShell command window run the following commands:
When prompted for a service account, type contoso\fsgmsa$ (Or whatever account you created)
NEXT STEP IMPORTANT: After you have run the PowerShell command on your ADFS server open the AD FS Management console. Navigate to Authentication Policies. Select Edit Global Primary Authentication. Select the checkbox next to Enable Device Authentication and then click OK.
Lastly, you will need to make sure you have the following DNS records for the Device Registration Services.
IP address of the AD FS server
You can use the following procedure to add a host (A) resource records to corporate DNS for federation server and the device registration service.
- On DC1, from Server Manager, from the Tools menu, click DNS to open the DNS snap-in.
- In the console tree, expand DC1, expand Forward Lookup Zones, right-click contoso.com, and then click New Host (A or AAAA).
- In Name, type the name you will use for your AD FS farm, for this walkthrough, type adfs1.
- In IP address, type the IP address of the ADFS1 server. Click Add Host.
- Right-click contoso.com, and then click New Alias (CNAME).
- In the New Resource Record dialog box, type enterpriseregistration in the Alias name box.
In the Fully Qualified Domain Name (FQDN) of the target host box, type adfs1.contoso.com and click OK.
Configure Windows Client
- Log on to your Windows 8 Client with your Microsoft account.
- On the Start screen, open the Charms bar and then select the Settings charm. Select Change PC Settings.
- On the PC Settings page, select Network and then click Workplace.
- In the Enter your UserID to get workplace access or turn on device management box, type <login name>@<domain.com> and then click Join.
- When prompted for credentials, type your domain credentials and Click OK.
- You should now see the message: This device has joined your workplace network.
If you want to learn how to set this up for your iOS devices check out this article: Walkthrough Guide- Workplace Join with an iOS Device
As you can see there a lot of moving parts to get this in working, and from my experience you want to make sure you get the certificates correct or you will be troubleshooting into the late evening.
If you want to see this in action, check out this great video by John Savill:
For the full list in the series: Windows Server 2012 R2 Launch Blog Series Index #WhyWin2012R2
It's 2:15pm on a Friday, and I'm sitting in the keynote hall at PyCon 2013 fidgeting through a succession of lightning talks that have very little relevance to my life. Topics like "Python code coverage techniques" (ho-hum) and "Controlling Christmas lights with Python” (yawn - I wonder if there's anything new on Hacker News)...when Solomon Hykes takes the stage, unveils Docker, and the world shifts. If you haven't seen it yet, you should watch the video of Solomon's Pycon The Future of Linux C...
Mar. 31, 2015 05:00 PM EDT Reads: 501
OmniTI has expanded its services to help customers automate their processes to deliver high quality applications to market faster. Consistent with its focus on IT agility and quality, OmniTI operates under DevOps principles, exploring the flow of value through the IT delivery process, identifying opportunities to eliminate waste, realign misaligned incentives, and open bottlenecks. OmniTI takes a unique, value-centric approach by plotting each opportunity in an effort-payoff quadrant, then work...
Mar. 31, 2015 04:00 PM EDT Reads: 1,049
SYS-CON Events announced today that MangoApps will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY., and the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. MangoApps provides private all-in-one social intranets allowing workers to securely collaborate from anywhere in the world and from any device. Social, mobile, and eas...
Mar. 31, 2015 03:00 PM EDT Reads: 3,179
SYS-CON Events announced today that Solgenia will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY, and the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Solgenia is the global market leader in Cloud Collaboration and Cloud Infrastructure software solutions. Designed to “Bridge the Gap” between Personal and Professional S...
Mar. 31, 2015 03:00 PM EDT Reads: 2,996
When it comes to microservices there are myths and uncertainty about the journey ahead. Deploying a “Hello World” app on Docker is a long way from making microservices work in real enterprises with large applications, complex environments and existing organizational structures. February 19, 2015 10:00am PT / 1:00pm ET → 45 Minutes Join our four experts: Special host Gene Kim, Gary Gruver, Randy Shoup and XebiaLabs’ Andrew Phillips as they explore the realities of microservices in today’s IT worl...
Mar. 31, 2015 12:45 PM EDT Reads: 1,911
This month I want to revisit supporting infrastructure and datacenter environments. I have touched (some would say rant) upon this topic since my post in April 2014 called "Take a Holistic View of Support". My thoughts and views on this topic have not changed at all: it's critical for any organization to have a holistic, comprehensive strategy and view of how they support their IT infrastructure and datacenter environments. In fact, I believe it's even more critical today then it was a year ago ...
Mar. 31, 2015 12:00 PM EDT Reads: 774
The world's leading Cloud event, Cloud Expo has launched Microservices Journal on the SYS-CON.com portal, featuring over 19,000 original articles, news stories, features, and blog entries. DevOps Journal is focused on this critical enterprise IT topic in the world of cloud computing. Microservices Journal offers top articles, news stories, and blog posts from the world's well-known experts and guarantees better exposure for its authors than any other publication. Follow new article posts on T...
Mar. 31, 2015 12:00 PM EDT Reads: 1,547
Hosted PaaS providers have given independent developers and startups huge advantages in efficiency and reduced time-to-market over their more process-bound counterparts in enterprises. Software frameworks are now available that allow enterprise IT departments to provide these same advantages for developers in their own organization. In his workshop session at DevOps Summit, Troy Topnik, ActiveState’s Technical Product Manager, will show how on-prem or cloud-hosted Private PaaS can enable organ...
Mar. 31, 2015 12:00 PM EDT Reads: 1,382
Cloud computing is changing the way we look at IT costs, according to industry experts on a recent Cloud Luminary Fireside Chat panel discussion. Enterprise IT, traditionally viewed as a cost center, now plays a central role in the delivery of software-driven goods and services. Therefore, companies need to understand their cloud utilization and resulting costs in order to ensure profitability on their business offerings. Led by Bernard Golden, this fireside chat offers valuable insights on ho...
Mar. 31, 2015 11:45 AM EDT Reads: 953
Microservice architectures are the new hotness, even though they aren't really all that different (in principle) from the paradigm described by SOA (which is dead, or not dead, depending on whom you ask). One of the things this decompositional approach to application architecture does is encourage developers and operations (some might even say DevOps) to re-evaluate scaling strategies. In particular, the notion is forwarded that an application should be built to scale and then infrastructure sho...
Mar. 31, 2015 11:00 AM EDT Reads: 2,557
SYS-CON Events announced today the IoT Bootcamp – Jumpstart Your IoT Strategy, being held June 9–10, 2015, in conjunction with 16th Cloud Expo and Internet of @ThingsExpo at the Javits Center in New York City. This is your chance to jumpstart your IoT strategy. Combined with real-world scenarios and use cases, the IoT Bootcamp is not just based on presentations but includes hands-on demos and walkthroughs. We will introduce you to a variety of Do-It-Yourself IoT platforms including Arduino, Ras...
Mar. 31, 2015 11:00 AM EDT Reads: 2,222
Even though it’s now Microservices Journal, long-time fans of SOA World Magazine can take comfort in the fact that the URL – soa.sys-con.com – remains unchanged. And that’s no mistake, as microservices are really nothing more than a new and improved take on the Service-Oriented Architecture (SOA) best practices we struggled to hammer out over the last decade. Skeptics, however, might say that this change is nothing more than an exercise in buzzword-hopping. SOA is passé, and now that people are ...
Mar. 31, 2015 11:00 AM EDT Reads: 1,394
Microservices are the result of decomposing applications. That may sound a lot like SOA, but SOA was based on an object-oriented (noun) premise; that is, services were built around an object - like a customer - with all the necessary operations (functions) that go along with it. SOA was also founded on a variety of standards (most of them coming out of OASIS) like SOAP, WSDL, XML and UDDI. Microservices have no standards (at least none deriving from a standards body or organization) and can be b...
Mar. 31, 2015 10:45 AM EDT Reads: 2,262
Right off the bat, Newman advises that we should "think of microservices as a specific approach for SOA in the same way that XP or Scrum are specific approaches for Agile Software development". These analogies are very interesting because my expectation was that microservices is a pattern. So I might infer that microservices is a set of process techniques as opposed to an architectural approach. Yet in the book, Newman clearly includes some elements of concept model and architecture as well as p...
Mar. 31, 2015 10:15 AM EDT Reads: 2,192
You hear the terms “subscription economy” and “subscription commerce” all the time. And with good reason. Subscription-based monetization is transforming business as we know it. But what about usage? Where’s the “consumption economy”? Turns out, it’s all around us. When most people think of usage-based billing, the example that probably comes to mind first is metered public utilities — water, gas and electric. Phone services, especially mobile, might come next. Then maybe taxis. And that’s ab...
Mar. 31, 2015 10:00 AM EDT Reads: 873
SYS-CON Events announced today the DevOps Foundation Certification Course, being held June ?, 2015, in conjunction with DevOps Summit and 16th Cloud Expo at the Javits Center in New York City, NY. This sixteen (16) hour course provides an introduction to DevOps – the cultural and professional movement that stresses communication, collaboration, integration and automation in order to improve the flow of work between software developers and IT operations professionals. Improved workflows will res...
Mar. 31, 2015 10:00 AM EDT Reads: 1,753
As a group of concepts, DevOps has converged on several prominent themes including continuous software delivery, automation, and configuration management (CM). These integral pieces often form the pillars of an organization’s DevOps efforts, even as other bigger pieces like overarching best practices and guidelines are still being tried and tested. Being that DevOps is a relatively new paradigm - movement - methodology - [insert your own label here], standards around it have yet to be codified a...
Mar. 31, 2015 10:00 AM EDT Reads: 882
Microservices, for the uninitiated, are essentially the decomposition of applications into multiple services. This decomposition is often based on functional lines, with related functions being grouped together into a service. While this may sound a like SOA, it really isn't, especially given that SOA was an object-centered methodology that focused on creating services around "nouns" like customer and product. Microservices, while certainly capable of being noun-based, are just as likely to be v...
Mar. 31, 2015 10:00 AM EDT Reads: 1,966
Containers and microservices have become topics of intense interest throughout the cloud developer and enterprise IT communities. Accordingly, attendees at the upcoming 16th Cloud Expo at the Javits Center in New York June 9-11 will find fresh new content in a new track called PaaS | Containers & Microservices Containers are not being considered for the first time by the cloud community, but a current era of re-consideration has pushed them to the top of the cloud agenda. With the launch ...
Mar. 31, 2015 09:15 AM EDT Reads: 2,291
An explosive combination of technology trends will be where ‘microservices’ and the IoT Internet of Things intersect, a concept we can describe by comparing it with a previous theme, the ‘X Internet.' The idea of using small self-contained application components has been popular since XML Web services began and a distributed computing future of smart fridges and kettles was imagined long back in the early Internet years.
Mar. 31, 2015 09:00 AM EDT Reads: 2,232