![\"Smile\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/wlEmoticon-smile1.png\")
<\/p>\nI can\u2019t tell you how excited I am to finally write this post <\/p>\n
Yesterday we released the Technical Preview of Windows Server 2016<\/a>. Yes, it supports containers natively<\/a>, awesome and groundbreaking,\u00a0 yadda yadda yadda\u2026 but if you follow this blog, I know what you look for every time a new Windows Server comes out: if there are news in ADFS, isn\u2019t it? The ADFS team is going to deliver docs that will cover all the new functionality, but I was too excited to wait \u2013 and I suspect you will be in the same boat, too. So I quickly set up a VM, fiddled with the new ADFS app configuration features and adapted some of our Azure AD sample code to do OpenId Connect based sign in against ADFS. That was all surprisingly fast\u2026 and easy<\/em><\/strong>. The blog below documents that journey. It barely scratches the surface of what\u2019s possible with the new ADFS, but I hope it will show you enough to entice you to try it yourself.<\/p>\n As you guys know, my administrative skills are nil. Every single time I need something administrative done, I hit Lync \u2013 err… Skype for Business I mean \u2013 and beg Sam or Dean Wells for their help. But this time I could not wait, hence I decided to try my luck and do it myself. Turns out, it wasn\u2019t that hard.<\/p>\n First thing, I downloaded the ISO of WS2013 TP3 from here<\/a>. All it took was a quick & painless sign in and registration with my MSA. The file is 4.8 GB.<\/p>\n That done, I set up a new VM in hyper-V. Note, this is all done on my Surface Pro 3 with Windows 10 Pro. I gave the machine 1GB of RAM (although Windows Server only required 512Mb for running, the VM setup will fail with just that. You can reduce it later) and made sure that I had a decent amount of free space on my disk. Turns out that I didn\u2019t delete my old Windows.old folder \u2013 between that and other housekeeping I ended up with 40Gb free, which were enough to set things up. The VHDX after all the setups is 10.4Gb, hence very reasonable. As network, I assigned to the VM the \u201cSurface Ethernet Adapter Virtual Switch\u201d \u2013 something about the physicality of an ethernet connection makes me feel good. Also remember, when it comes to admin I don\u2019t know what I am doing.<\/p>\n During the VM creation, I specified the downloaded ISO as the setup disk. The booted the VM, and witnessed the usual magic of doing a Windows installation entirely from one SSD \u2013 super fast. During the Windows setup I have chosen the \u201cwith desktop\u201d variant, which for some mysterious reason is not the default. I guess that working on a no-GUI environment satisfies some self-image requirements for admins\u2026 J\/K, of course Anyhow, shortly after I was welcomed by the awesome Windows 10 theme. Ta-dahhh.<\/p>\n If you set up ADFS in the past, you know what\u2019s next. I had to create an AD, which in my thrift setup meant promoting the VM to be a domain controller. That done, I had to configure the ADFS service.<\/p>\n First thing, I went to the server manager\/local server tab, scrolled down to roles & features, and under \u201ctasks\u201d I selected \u201cAdd Roles and Features\u201d.<\/p>\n Here, I selected AD DS and ADFS \u2013 as shown below. Note: IIS is not in the default roles, not I am adding it here. Why? Because ADFS in WS2016 does not need it \u2013 it\u2019s all self hosted!<\/p>\n That done, I hit next until Install was the only option \u2013 and chose it. After some progress bar fun, I landed on the screen below.<\/p>\n Very helpful! I was able to trigger the next step, \u201cpromote this server to a domain controller\u201d, just by clicking on the corresponding link.<\/p>\n I won\u2019t bore you with all the details \u2013 also because I did that this morning and I am writing this blog few hours into the evening, hence I simply don\u2019t remember. The main thing I\u2019ll point out is that I chose the \u201cadd new forest\u201d given that I want a brand new AD, and that I turned off the DNS service because I don\u2019t need it. Ah, and when you are asked to create a new password \u2013 make sure you remember what you choose. It will be required later.<\/p>\n Once you have done all that, the DCpromo will take place\u2026 and will take some time, requiring a long reboot. Not as long as it was in the past, I gather, but not instantaneous nonetheless.<\/p>\n Once you come back in, you\u2019ll be reminded in various places that you didn\u2019t set up ADFS yet \u2013 just click on any of those and you\u2019ll end up in the configuration wizard. Unfortunately I didn\u2019t take too many screenshots of the process, I was too impatient to get to the apps part Anyhow. Before starting the ADFS configuration in earnest, there\u2019s one task that one has to do: get a certificate that will be used for transport security and signature purposes. Traditional walkthroughs suggest to get a self signed certificate via IIS, but per the above I didn\u2019t have it installed here and did not want to install it just for spitting out an X509. Luckily, I found a super handy way of doing that via Powershell! It\u2019s all thanks to this article from my good friend Orin<\/a>. I opened a Powershell prompt and entered the following:<\/p>\n That command created a selfsigned certificate with a subject of my choosing, of the form <machinename>.<domain>, and saved it on the local machine cert store. The command output provided me with the certificate thumbprint.<\/p>\n Next, I exported the certificate to file \u2013 just in case. The next 2 cmdlets did that for me: note that I used the thumbprint for identifying the certificate.<\/p>\n That done, I went back to the ADFS setup wizard. I am sure you\u2019ll find your way through it, but here there are few hints:<\/p>\n Once you are done, you should land on the screen below. The warnings below do sound a bit scary, but in the end they did not interfere with setting up the application.<\/p>\n We are almost done with the setup! I did just another couple of things.<\/p>\n First, I created one test user in the directory \u2013 I don\u2019t like to use the domain admin user directly, given that it has all sorts of odd constraints that are there for excellent reasons in prod but are in the way while developing.<\/p>\n Second, I had to set things up so that I could see ADFS from my host machine, the Surface. To that end:<\/p>\n NOW we get to the fun part. Go back to the VM and open the ADFS management console.<\/p>\n There are lots of interesting news you can find if you drill on each of the folders on the left, but here we\u2019ll concentrate on the most obvious new entry \u2013 the Application Groups folder. That\u2019s the place where ADFS stores application settings. Select it and choose \u201cAdd application group\u201d. You\u2019ll see the wizard below.<\/p>\n The idea is self-explanatory: you are offered a set of application or application topologies templates, covering the gamut of moving parts you encounter in modern authentication. Select some of the entries randomly and you\u2019ll see the wizard steps adapt to the task, growing and shrinking.<\/p>\n Here I am going to the simplest scenario, a web application \u2013 hence I pick up the \u201cserver application or Website\u201d, fill up name and description and click next.<\/p>\n Looks familiar? : The next steps tells you upfront what clientid is being assigned to your app, and asks you to supply the redirect_uri to use for sending tokens. I plan to use our Azure AD samples or a VS2015 ASP.NET template for actually implement the app, hence I already know what URL to use \u2013 it\u2019s the usual https:\/\/localhost:44300<\/a><\/span>\/ for VS2015 or https:\/\/localhost:44320<\/a><\/span>\/ for the sample. I can add both, just in case! Once done, I click next.<\/p>\n Here I can select which credentials to assign to my app \u2013 big news, given that ADFS didn\u2019t support confidential clients until now. I don\u2019t plan to use any flow requiring creds in this post, but I am adding it anyway for the LOLZ. I chose the \u201cgenerate a shared secret\u201d, corresponding to the string key we use in almost all Azure AD samples. Note that if you don\u2019t write that down NOW, it\u2019s lost forever and you\u2019ll have to reset it\u2026 just like its cloud counterpart.<\/p>\n Also note, super interesting: ADFS can use windows integrated auth as a credential for confidential clients<\/u><\/strong>. That makes total sense\u2026 and it\u2019s awesome. Just think of the daemon scenarios this enables.<\/p>\n Finally, here there\u2019s the summary. It took what \u2013 40 seconds? Pretty awesome.<\/p>\n And we are done \u2013 I mean done done! I can almost hear you. If you have used ADFS in the past, you\u2019re likely to blurt out \u201cwait a minute, what about defining the relying party trust? What about claims mappings\u201d? Have faith, my friends I am finally back on my territory. Setting up an app for talking OpenId Connect to Azure AD or ADFS is, surprise surprise, almost exactly the same operation. There are two quick ways of getting to the app we want. One is to use the VS2015 ASP.NET templates to create an app configured to connect to Azure AD, then modify it to talk to ADFS. The other is to clone one of the OpenId Connect samples for Azure AD, and modify it in the same way (the templates are modeled after the samples). Earlier today I did the templates approach, but for this post I\u2019ll show you how to modify our WebApp-OpenIdConnect-DotNet<\/a> sample.<\/p>\n Let\u2019s start by cloning the sample. On Windows I like to use the GitHub desktop client, but of course you can use whatever you prefer.<\/p>\n Open the solution in whatever IDE you prefer. The changes are going to be pretty minimal. Here I\u2019ll use VS2013, which just after few weeks of VS2015 already feels retro!<\/p>\n Once the solution is open, compile it \u2013 so that all the missing NuGets are restored. That done, head to the web.config and modify the ida: appSettings entries as follows:<\/p>\n <\/p>\n In details, the modifications here are:<\/p>\n That done, we need to tweak the OpenId Connect middleware initialization logic. Head to App_Start\/Startup.Auth.cs, and modify the string inits at the beginning of the file as shown below:<\/p>\n <\/p>\n No mysteries here, we are just reflecting the changes in the web.config here in code. That done, modify the OpenId Connect middleware options as in the following.<\/p>\n What changed:<\/p>\n That\u2019s it! Hit F5.<\/p>\n Here there\u2019s our good old sample UX.<\/p>\n Hit Sign in.<\/p>\n Ha! This is exciting! It\u2019s the ADFS default page for forms auth \u2013 very similar to the Azure AD one. Here I am signing in as my test user.<\/p>\n And uneventfully, I am signed in! Note the classic domain\\username identifier on the top right corner \u2013 the logic originally written for Azure AD worked just as well for ADFS.<\/p>\n If you are curious about the content of the default id_token you get from ADFS, you can inspect the incoming ClaimsPrincipal in the index controller (or the immediate window) by adding ClaimsPrincipal<\/span> cp = ClaimsPrincipal.Current;<\/span> (which comes from the System.Security.Claims<\/span> namespace BTW). Screenshot below:<\/p>\n
\nBoy, does this release deliver on that. ADFS in Windows Server 2016 TP3 comes with brand new support for OpenId Connect web sign on and for OAuth2 confidential clients \u2013 moreover, it makes it easy to manage all that through its MMC. No more fiddling with Powershell\u2026 unless you are a Powershell wizard, in which case – carry on, good sir\/madam. <\/p>\nSetting up ADFS in Windows Server 2016 TP3<\/h2>\n
<\/p>\n![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb1.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb2.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb3.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb4.png\" "\\"image\\"")
<\/a><\/p>\n but if I figured this out, I am sure you can figure this out too\u2026 also remember, this is a super early post. The official documentation will follow soon.<\/p>\nNew-SelfSignedCertificate<\/strong> -certstorelocation cert:\\localmachine\\my -dnsname WS2016TP3.vibrodomain.net<\/pre>\n
<\/pre>\n
$pwd = ConvertTo-SecureString<\/strong> -String \"whatevah\"<\/span> -Force \u2013AsPlainText<\/pre>\nExport-PfxCertificate<\/strong> -cert cert:\\localMachine\\my\\1C14CE8E9077970CE27D2ED58154ED6B7F768401 -FilePath c:\\WS2016TP3.vibrodomain.net.pfx -Password $pwd<\/pre>\n
\n
![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb5.png\" "\\"image\\"")
<\/a><\/p>\n\n
Setting up a Web App for OpenId Connect sign in ADFS<\/h2>\n
![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb6.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb7.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb8.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb9.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb10.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb11.png\" "\\"image\\"")
<\/a><\/p>\n none of that will be necessary.<\/p>\nSetting up an MVP App to Authenticate via OpenId Connect and ADFS<\/h2>\n
![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb12.png\" "\\"image\\"")
<\/a><\/p>\n<<\/span>add<\/span> key<\/span>=\"ida:ClientId\"<\/span> value<\/span>=\"8219ab4a-df10-4fbd-b95a-8b53c1d8669e\"<\/span> \/><\/span>\r\n<<\/span>add<\/span> key<\/span>=\"ida:ADFSDiscoveryDoc\"<\/span> value<\/span>=\"https:\/\/ws2016tp3.vibrodomain.net\/adfs\/.well-known\/openid-configuration\"<\/span> \/><\/span>\r\n<!--<add key=\"ida:Tenant\" value=\"[Enter tenant name, e.g. contoso.onmicrosoft.com]\" \/><\/span>\r\n<add key=\"ida:AADInstance\" value=\"https:\/\/login.microsoftonline.com\/{0}\" \/>--><\/span>\r\n<<\/span>add<\/span> key<\/span>=\"ida:PostLogoutRedirectUri\"<\/span> value<\/span>=\"https:\/\/localhost:44320\/\"<\/span> \/><\/span><\/pre>\n\n
![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb13.png\" "\\"image\\"")
<\/a><\/p>\n\n
private<\/span> static<\/span> string<\/span> clientId = ConfigurationManager.AppSettings[\"ida:ClientId\"<\/span>];\r\n\/\/private static string aadInstance = ConfigurationManager.AppSettings[\"ida:AADInstance\"];<\/span>\r\n\/\/private static string tenant = ConfigurationManager.AppSettings[\"ida:Tenant\"];<\/span>\r\nprivate<\/span> static<\/span> string<\/span> metadataAddress = ConfigurationManager.AppSettings[\"ida:ADFSDiscoveryDoc\"<\/span>];<\/strong>\r\nprivate<\/span> static<\/span> string<\/span> postLogoutRedirectUri = ConfigurationManager.AppSettings[\"ida:PostLogoutRedirectUri\"<\/span>];\r\n<\/pre>\napp.UseOpenIdConnectAuthentication(\r\n new<\/span> OpenIdConnectAuthenticationOptions\r\n {\r\n ClientId = clientId,\r\n \/\/Authority = authority,<\/span>\r\n MetadataAddress = metadataAddress,\r\n RedirectUri = postLogoutRedirectUri,<\/strong>\r\n PostLogoutRedirectUri = postLogoutRedirectUri,\r\n<\/pre>\n\n
![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb14.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb15.png\" "\\"image\\"")
<\/a><\/p>\n![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb16.png\" "\\"image\\"")
<\/a><\/p>\n
![\"image\"](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/image_thumb17.png\" "\\"image\\"")
<\/a><\/p>\n![\"Winking](\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2015\/08\/wlEmoticon-winkingsmile.png\")
<\/p>\n