Re: ADFS Proxy setup?

Ah yes, you need a client certificate for the proxy. For the purposes of
the demo, you can self issue this too. SelfSSL is used for doing SSL certs,
but you can use certutil to create one. When you go to production, you can
either buy a client cert from a vendor (just like buy SSL certs, but
generally cheaper!), or you can stand up your own CA. For this cert, only
your federation server needs to trust it, so you don't have the same issues
to consider with SSL certs for your internet facing stuff and your token
signing certs. You generally want those chaining to a trusted root so you
don't have to cajole all of your external orgs to trust your certs. :)

There are some nice docs here:
http://technet2.microsoft.com/WindowsServer/en/library/4b9e6078-6b7d-4cc1-a927-77c1eab7c1341033.mspx?mfr=true

http://technet2.microsoft.com/WindowsServer/en/library/4b9e6078-6b7d-4cc1-a927-77c1eab7c1341033.mspx?mfr=true

The section in the operations guide on TechNet2 is really good and useful.
Besides the link that shows how to use certutil to create a self-signed cert
for the proxy, they really do tell you just about everything you need to
know. I recommend reading the whole ADFS "operations" part of the tree.
That's where all the useful details are.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Dom Williams" <dominic.williams@xxxxxxxxx> wrote in message
news:1154620970.423308.248640@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Well, I dont know how to set one up :)

Some background...

I have the step-by-step environment (adatum & trey) working in a VM
environment. I'd like to introduce the proxies to observe behavior &
understand how it all works.

I used selfssl on the ADs & webserver, but I think a different kind of
cert is needed for the proxy? (forgive my ignorance here, I'm a bit
weak on certificate services material)

basically, does anyone know how to set one up w.o standing up a CA?
...I'll get one up if I need to, but right now i'm just looking for the
most simple way to take things to the next level.

Thanks!


Joe Kaplan (MVP - ADSI) wrote:
What isn't working?

I'm not actually using the proxy in my setup, but I know a little about
how
it works.

Some of the tricks are that you need to create the client auth
certificate
for it and get that installed correctly so that the FS will trust the
FSP.
There is also a bit of trickery you may need to do if you want to use the
FS
and the FS-P in the same environment, but use the same DNS name for both.
Brian Puhl talked about how he did that for the MS ADFS implementation at
his session at TechEd.

Joe K.



.

Relevant Pages

  • Re: HTTPS proxy tool that resigns SSL certs
    ... > Does anyone know of an HTTPS proxy tool that will let you resign SSL> certificates when doing a MITM attack? ... but this will still pop up a certificate warning. ... > client end network - DNS, routing, etc... ...
    (Pen-Test)
  • Re: Preventing tunnels through HTTPS proxies
    ... The client is given a Certificate signed by the proxy that ... who then will present its certificate to the ... proxy (now becoming the client). ... Next step is a redirect to the main requested website, i prefer use HTTP ...
    (Security-Basics)
  • Re: Client certificate error with web services
    ... The number of times that client certificate issues turn out to be easy to ... Joe Kaplan-MS MVP Directory Services Programming ... Assuming that the CNs are the same in both certs, ... Authentication is via client certificates. ...
    (microsoft.public.dotnet.security)
  • Re: RPC Over HTTP
    ... I am having trouble with the actual proxy ... >What URL do you use to access your SBS from a remote ... >CEICW and create the certificate. ... >time you connect from a remote client, ...
    (microsoft.public.windows.server.sbs)
  • Re: [fw-wiz] Application Proxy/L7 Firewall Recommendation?
    ... > certificate presented by your decrypting proxy doesn't match the expected ... > certificate of the site I'm connecting to. ... The client must trust this CA ... The generated cert is then used to initiate a TLS session with the client ...
    (Firewall-Wizards)
Quantcast