Secure RDWeb using Azure Multi-Factor Authentication



ADFS WAP: How to configure SSO with RDWeb


1.  System Deploy

  • ADFS : th-adfs2012.mfalab3.com
  • ADFS WAP : th-adfs2012wap.mfalab3.com
  • RDWeb : th-rds.mfalab3.com

A public IP for ADFS WAP points to ADFS/RDS as well

 

2.  Setting on ADFS

Create a Relying Parth Trust

 

 

3.  Setting on ADFS WAP

Create WAP Application,

Add-WebApplicationProxyApplication -Name 'rdweb' -ExternalUrl 'https://th-rds.mfalab3.com/rdweb/' -BackendServerURL 'https://th-rds.mfalab3.com/rdweb/' -ExternalPreAuthentication ADFS -ADFSRelyingPartyName rdweb1 -ExternalCertificateThumbprint '67D438BDDBB455E53CA83D6F5DEC34CC546F711A'

 

4.  Setting on RDS

Important : Change authentication method to "Windows"

https://social.technet.microsoft.com/Forums/office/en-US/999f56fa-a218-41b0-86ee-2845269d93ef/rdweb-authentication?forum=winserverTS

 

5.  Setting on the Client Computers

6. See how it works

 


Azure Automation step-by-step guide for Auto-Shutdown Virtual Machine.


-     Create an Azure account

 

-     Go "setting" and assign the user as the Co-administrator

-     Select automation and create an Automation Account, in this example "gwauto"
-     Select the created Automation Account
-     Create a new runbook, in the example, "shutdown-vm"
-     Click runbook "shutdown-vm" to create/edit a script
-     Click Author -> insert script -> Test -> Publish

 

===================== Script example of shutdown-vm=====================

workflow shutdown-vm

{

$username = "azureauto@mfa01.onmicrosoft.com"

$pass = "      "

$password=$pass|ConvertTo-SecureString -AsPlainText -Force

$mycred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username,$password

Add-AzureAccount -Credential $mycred

 

$AzureSubscriptions = Get-AzureSubscription

foreach ($subscription in $AzureSubscriptions)

{

    Select-AzureSubscription -SubscriptionName $subscription.SubscriptionName

    #Write-Host $subscription.SubscriptionName

 

    foreach ($vm in Get-AzureVM)

    {

        $name = $vm.Name

        $servicename = $vm.ServiceName

   

        If($vm.Status -ne 'StoppedDeallocated')

        {

            # Add the VM's which should not be shutdown

            Stop-AzureVM -Service $servicename -name $name -Force

        }

    }

}

}

-     Schedule the runbook


Azure: How to unregister and register ADFS Authentication Provider (MFA)


When Azure subscription is changed,due to a provider change, Azure Multi-Factor Authentication(AKA, MFA) must be unregistered and registered again by following method.

1. Un-register MFA provider, on ADFS Global Authentication Policy, uncheck WindowsAzureMultiFactorAuthentication checkbox.

Go to PowerShell prompt, then run

PS C:\Program Files\Multi-Factor Authentication Server> Unregister-AdfsAuthenticationProvider –Name"WindowsAzureMultiFactorAuthentication"

WARNING: PS0103: The authentication provider was successfully unregistered from the policy store.  Restart the A

D FS Windows Service on each server in the farm.

Restart ADFS services

PS C:\Program Files\Multi-Factor Authentication Server> net stop adfssrv

The Active Directory Federation Services service is stopping.....

The Active Directory Federation Services service was stopped successfully.

PS C:\Program Files\Multi-Factor Authentication Server> net start adfssrv

The Active Directory Federation Services service is starting....

The Active Directory Federation Services service was started successfully.

Go back to ADFS Global Authentication Policy and see if there is no "WindowsAzureMultiFactorAuthentication"

2. Register MFA provider again,

To register again, run following from PowerShell prompt

PS C:\Program Files\Multi-Factor Authentication Server> .\Register-MultiFactorAuthenticationAdfsAdapter.ps1

WARNING: PS0114: The authentication provider was successfully registered with the policy store.  To enable this

provider, you must restart the AD FS Windows Service on each server in the farm.

Restart ADFS services

PS C:\Program Files\Multi-Factor Authentication Server> net stop adfssrv

The Active Directory Federation Services service is stopping.....

The Active Directory Federation Services service was stopped successfully.

PS C:\Program Files\Multi-Factor Authentication Server> net start adfssrv

The Active Directory Federation Services service is starting....

The Active Directory Federation Services service was started successfully.

Go back to ADFS Global Authentication Policy and see if "WindowsAzureMultiFactorAuthentication" is back.


Azure Multi-Factor Authentication : Import users from multiple domains(Forest Trust)


Here are a simple step by step guide and instruction how to import/synchronize users from forest/domain trust

  • System deployment example

-          AD netbios 1 : th–ad02, Domain 1 : mfalab4.com

-          AD netbios 2 : th–ad03, Domain 2 : mfalab5.com

  • Configuration of Forest/Domain trust

  • Check if both domain trust are listed from Multi-Factor Authentication Directory Sync


Configure Sharepoint access from External network


Step 1. From Central Administration, select "Configure alternative access mapping".

Step 2. Select URL to be edited and click "Edit Public URLs".

Step 3. Enter desired IP or URL shown below.

Step 4. Enter desired IP or URL shown below.

See Also


Create a custom VM into Existing Resource Group using Azure RM PowerShell


#Install Azure RM module if missing and Login to Azure

Install-Module -name AzureRM -AllowClobber

Login-AzureRmAccount

Get-AzureRmSubscription

 

#Set Variables

$subscriptionId =  'd855443e-XXXX-4a82-9a63-XXXXXXXXXXXX

$storageAccountName = 'YourStorageAccountName'

$sourceImageUri = https://YourStorageAccountName.blob.core.windows.net/vhds/YourUploadedVHDName.vhd'

 

$resourceGroupName     = "YourResourceGroupName"

$locationName          = "YourLocationName"                                    => Ex) Japan East

$vnetName              = "YourExistingVirtualNetworkName"

$vmnetinf              = "YourNewNetworkInterfaceName"

$backendSubnetName     = "YourExistingSubNetName"

$remoteAccessNSGName   = "YourNewNSGName "

$vmname                = "YourNewVMName"

$vmSize                = "YourNewVMSize"                                               => Ex) Standard_D1

$osDiskName            = $vmname+'_osDisk'

 

$virtualNetwork = Get-AzureRmVirtualNetwork -ResourceGroupName $resourceGroupName -Name $vnetName

 

$publicIp = New-AzureRmPublicIpAddress -Name $vmname -ResourceGroupName $ResourceGroupName -Location $locationName -AllocationMethod Dynamic

$networkInterface = New-AzureRmNetworkInterface -ResourceGroupName $resourceGroupName -Name $vmnetinf -Location $locationName -SubnetId $virtualNetwork.Subnets[0].Id -PublicIpAddressId $publicIp.Id

 

$vmConfig = New-AzureRmVMConfig -VMName $vmname -VMSize $vmSize

$vmConfig = Set-AzureRmVMOSDisk -VM $vmConfig -Name $osDiskName -VhdUri $sourceImageUri -CreateOption Attach -Windows

$vmConfig = Add-AzureRmVMNetworkInterface -VM $vmConfig -Id $networkInterface.Id

 

$vm = New-AzureRmVM -VM $vmConfig -Location $locationName -ResourceGroupName $resourceGroupName


Hello world!


Welcome to Technet. This is your first post. Edit or delete it, then start blogging!