Administrator Guide

• Federated Identities to Windows Azure Pack through AD FS – Part 1 of 3
• Federated Identities to Windows Azure Pack through AD FS – Part 2 of 3
For additional information, see Congure A
ctive Directory Federation Services for Windows Azure Pack and
AD FS 2.0 Cmdlets in
Windo
ws PowerShell in the TechNet Library.
2 Congure the t
enant authentication site to trust AD FS.
Connect to the tenant portal VM (<
Prex >-APT01), open a Windows PowerShell session, and run the following script.
NOTE
: First, replace the values in bold.
For username and password values, specify the username and password of a user who is a member of the <
Prex >-Diag-Admins
group.
$fqdn = "<adfs.contoso.com"
$dbServer = "<Prefix>SQLIN01\SQLIN01"
$dbUser = "username"
$dbPassword = "password"
$portalConfigStoreConnectionString = [string]::Format('Data Source={0};Initial
Catalog=Microsoft.MgmtSvc.PortalConfigStore;User ID={1};Password={2}', $dbServer, $dbUser,
$dbPassword)
Set-MgmtSvcRelyingPartySettings -Target Tenant `
-MetadataEndpoint https://$fqdn/FederationMetadata/2007-06/FederationMetadata.xml `
-ConnectionString $portalConfigStoreConnectionString `
-DisableCertificateValidation
3 Congure AD FS t
o trust the tenant portal.
As an AD FS administrator, run the following Windows PowerShell script on the server on which AD FS is installed. Replace the values
in bold. F
or more information, see
Congure A
ctive Directory Federation Services for Windows Azure Pack.
$tenantRelyingPartyName = "Management Service - Tenant Site - 2012"
$tenantPortalUrl = "https://myfqdn:port"
$tenantRelyingPartyMetadataEndpoint = "$tenantPortalUrl/FederationMetadata/2007-06/
FederationMetadata.xml"
$identityProviderName = "Identity Provider Name – ex:Active Directory"
$transformationRules = (
"@RuleTemplate = ""LdapClaims"" @RuleName = ""UPN - LDAP"" c:[Type == ""http://
schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"", Issuer == ""AD
AUTHORITY""] => issue(store = ""Active Directory"", types = (""http://schemas.xmlsoap.org/ws/
2005/05/identity/claims/upn""), query = "";userPrincipalName;{0}"", param = c.Value);",
"@RuleTemplate = ""LdapClaims"" @RuleName = ""Groups - LDAP"" c:[Type == ""http://
schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"", Issuer == ""AD
AUTHORITY""] => issue(store = ""Active Directory"", types = (""http://schemas.xmlsoap.org/
claims/Group""), query = "";tokenGroups(domainQualifiedName);{0}"", param = c.Value);",
"@RuleTemplate = ""PassThroughClaims"" @RuleName = ""UPN - Passthrough"" c:[Type ==
""http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn""] => issue(claim = c);",
"@RuleTemplate = ""PassThroughClaims"" @RuleName = ""Groups - Passthrough"" c:[Type
== ""http://schemas.xmlsoap.org/claims/Group""] => issue(claim = c);")
$issuanceRules = (
"=> issue(Type = ""http://schemas.microsoft.com/authorization/claims/permit"", Value
= ""true"");")
$impersonationRules = (
"c:[Type == ""http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"",
Issuer =~""^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$"" ] =>
issue(store=""_ProxyCredentialStore"", types=(""http://schemas.microsoft.com/authorization/
claims/permit""),query=""isProxySid({0})"", param=c.Value );c:[Type == ""http://
schemas.microsoft.com/ws/2008/06/identity/claims/groupsid"", Issuer =~ ""^(AD AUTHORITY|SELF
AUTHORITY|LOCAL AUTHORITY)$"" ] => issue(store=""_ProxyCredentialStore"",types=(""http://
schemas.microsoft.com/authorization/claims/permit""),query=""isProxySid({0})"",
param=c.Value );c:[Type == ""http://schemas.microsoft.com/ws/2008/06/identity/claims/
42 Administration