In case you missed it:

Here is Part 1 - Overview

Here is Part 2 - Installing AD DS, AD CS, and DNS Records

Here is Part 3 - Installing SQL Database Services

Here is Part 4a - Installing CONTOSO's SharePoint Services

Here is Part 4b - Installing FABRIKAM's SharePoint Services

Here is Part 5a - Installing CONTOSO's AD FS Services

Here is Part 5b - Installing FABRIKAM's AD FS Services

Here is Part 6a - Installing CONTOSO's Web Application Proxies

Here is Part 6b - Installing FABRIKAM's Web Application Proxies

Here is Part 7 - Installing External DNS and Workstations

Here is Part 8 - Creating the circle of trust

Topology

The following topology highlights in yellow the servers and workstations that will be used in this post. If you wish to see the full topology click here

Configure CONTOSO's SharePoint Server

At this point SharePoint is configured to accept claims from a Trusted Identity Token issuer, in this case that is the AD FS servers, however the web applications within SharePoint need to be configured to use the new trusted identity token issuer as their authentication provider. For this lab we only have one web application, the following steps will configure it to accept claims.

1. Log into CONTOSO's SharePoint server
2. Open SharePoint's Central Administration web page
3. Click Application Management > Manage Web Applications
4. You should have a single web application similar to the one shown in the following figure.
   
   1. 
5. Highlight the web application and click Authentication Providers > Default
   
6. Scroll down to where it says Trusted Identity Provider, you should have an identity provider called ADFS similar to the following image.Click the "Trusted Identity Provider" checkbox > ADFS
   
   1. 
7. Uncheck Enable Windows Authentication
8. Scroll to the bottom and click Save
9. Repeat these steps for FABRIKAM's SharePoint server and web application.

The SharePoint web application is now configured to accept claims or more specifically a single claim; email addresses. Since we do not have Exchange in the lab environment, we will next have to go configure an email address for the test users or else we will be unable to authenticate to SharePoint.

Configure Test Accounts

• CONTOSO
  
  • Log into the CONTOSO domain controller and add administrator@contoso.com to the email field for the Administrator account
  • Create a new user called John Doe with an email address of jdoe@contoso.com
• FABRIKAM
  • Log into the FABRIKAM domain controller and add administrator@fabrikam.com to the email field for the Administrator account
  • Create a new user called Sarah Doe with an email address of sdoe@fabrikam.com

Test INTERNAL AD FS

1. Log into CONTOSO's workstation CONT-WK01 as the administrator.
2. Open IE and go to https://www.contoso.com
3. You should see the web page similar to the following figure
   
   1. 
4. Click Sign In in the upper right corner.
5. You should now be presented with an AD FS home realm discovery page which asks you which organization's credentials you would like to use to authenticate to the portal as shown in the following figure
   
   1. 
6. Click CONTOSO Users.
7. You should now be successfully signed into the CONTOSO portal using your email claim as evidenced by the email address in the upper right corner; shown in the following figure.
   
   1. 
8. Repeat this test with FABRIKAM. Make sure that you have provisioned an email address for the Administrator account in the FABRIKAM forest and click FABRIKAM users at the FABRIKAM AD FS home realm discovery page. After logging into a FABRIKAM workstation and going to https://www.fabrikam.com > Sign In you should be presented with a successful login as shown in the following figure.
   1. 

If you made it this far then congratulations are in order, you now have two organizations with AD FS and SharePoint fully configured. One thing I should point out before proceeding is that if you look at the images above you will notice that IE is in Private mode. I always use Private mode when testing AD FS because cookies are being set all over the place. If you use IE in normal mode closing and re-opening the browser will not delete the cookies, so if you recently made a change and want to test it, some of the cookies from the previous session may give you false positives or negatives. By testing in Private mode, you can be certain that closing and re-opening the browser will clear all of the previous settings. To open IE in private mode I press Windows+R and type iexplore -private

Test FEDERATED AD FS

Now it is finally time to test federated AD FS end-to-end. This is where a CONTOSO or FABRIKAM user logs into their local domain and can sign into the other organization's web portal using the federated trust.

1.  Log into the CONTOSO workstation
2. Open IE and go to https://www.fabrikam.com
   
3. Click Sign In
   
4. Select CONTOSO Users
   
5. Select CONTOSO Users again
   
6. You should now be signed into FABRIKAM's portal using CONTOSO's credentials as shown in the following figure.
   

The last test is to repeat these steps to test from the opposite direction. Don't forget you also have a completely external workstation called EX-WK-01 which you an use to test non-domain joined users. The only difference in the sign in experience will be that when you select CONTOSO Users or FABRIKAM Users you will be presented with the following login dialogue box since the AD FS server cannot obtain your domain credentials from your workstation. This prompt is the Web Application Proxy's Forms Based Authentication page which can be customized as needed. See here for more information.

BONUS

Everything is working as planned right? But how good would you rate the user experience at this point? More importantly how good would your users rate their user experience during the sign in process? Most Intranet users would not want to have to click Sign In then have to select CONTOSO or FABRIKAM Users just to sign into their own Intranet portal. Also, most users would not want to have to select their organization twice when logging into the federated organization's portal. The fix for both of these scenarios is to tell the AD FS server to use the Active Directory provider for Intranet users. This will eliminate the sign-in prompt that user's were getting from the Intranet AD FS server's home realm discovery process and make the login process more intuitive for Intranet users.

1. Log into CONTOSO's or FABRIKAM's server
2. Open an elevated PowerShell window and type the following command: Set-AdfsProperties -IntranetUseLocalClaimsProvider $true
   
3. Repeat these steps for the other organization's AD FS server
   
4. Log into CONT-WK01 > Open IE > go to https://www.contoso.com
   
5. Click Sign In
   
6. You will now be signed in without first being prompted to select CONTOSO Users or FABRIKAM Users
   
7. Next type https://www.fabrikam.com and click Sign In and select CONTOSO Users
   
8. You will now be signed in without having to select CONTOSO Users again
   

 Wrap-Up

At long last this series is complete. If you follow every step in the series you will have a complete end-to-end lab environment where you can test almost every possible AD FS scenario, and hopefully you have a better understanding of how federated AD FS works as well as how to configure the WAP and AD FS services to be highly available. Along the way I also provided tips and advice that I have accumulated after deploying and troubleshooting AD FS deployments for multiple customers. Speaking of troubleshooting see the following section for a few more troubleshooting tips in case your environment does not work as desired.

I am not a SharePoint expert but I am aware that People Picker's behavior within SharePoint changes after enabling AD FS, and some other changes happen behind the scenes as well. Ensure you fully understand the impact of those changes to SharePoint and how to mitigate them prior to making changes to a production SharePoint environment.

Troubleshooting

• You are unable to sign into the local SharePoint server using AD FS
  • Verify that SharePoint trusts the AD FS server's token signing certificate: SharePoint Management Shell > Get-SPTrustedRootAuthority
  • Verify that your Trusted Token Identity Issuer is property configured: SharePoint Management Shell > Get-SPTrustedIdentityTokenIssuer . What you are looking for here is that the Provider URI is correct, that the Default Provider Realm matches the AD FS server's provider realm, and that the signing certificate is in fact the certificate that is being used by the AD FS server. Also verify that the claim type is email address and that the Email Address is the identity claim
  • Verify that the account you are using has an email address. Log into the domain controller and enter the following commands from PowerShell: Get-ADUser Administrator -Properties * | fl name,mail if the mail attribute is empty, then the account will not work
  • Verify that your web application is configured with your AD FS Authentication Provider: SharePoint Management Shell > Get-SPWebApplication | %{Get-SPAuthenticationProvider -WebApplication $_.DisplayName -Zone "Default"} The display name and LoginProviderName should be ADFS
    
  • Verify that the AD FS SharePoint Relying Party trust is properly configured. Log into the AD FS Server > Elevated PowerShell > Get-AdfsRelyingPartyTrust -Name "SharePoint 2013". Make sure that Active Directory is configured as an IssuanceTransformRule and that is is configured to send Email Address claims.  Also make sure the Identifier value is the same as the Provider Realm within SharePoint's SPTrustedIdentityTokenIssuer configuration. Make sure that the WSFedEndpoint is the proper URL and ends in /_trust (i.e. https://www.contoso.com/_trust)
    
  • Make sure that DNS works everywhere. DNS problems will quickly break everything, make sure that the AD FS server can resolve the SharePoint address, vice versa, and that the desktop client can resolve the AD FS URL and the SharePoint URL. Make sure that the AD FS url resolves to the AD FS server not the WAP
    
• You are unable to sign into the remote SharePoint Server using AD FS
  • Before attempting to sign into a remote organization, make certain that AD FS is working internally, also make certain that AD FS is working internally for the remote organization.
    
  • If this is a lab environment, verify that certificate revocation checking works, or that is is disabled on both sides for both the relying party trusts and claims provider trusts and for both the signing and encrypting certificates (Get-AdfsRelyingPartyTrust / Get-AdfsClaimsProviderTrust)
    
  • Verify that both organizations can resolve their federation metadata and SharePoint URLs in DNS for the other organization
    
  • Ensure that the user account that is being used to test has an email address
    
  • Verify that the proper claims provider and relying party trusts are in place to send and accept the claims
    
  • Verify that the claims provider trust is configured to receive the email address as a claim and verify that the relying party trust is configured to send the email address as a claim
    
  • Verify that claim filtering, if configured is properly configured on both sides.
    
  • Verify that each organization resolves to the WAP's IP address in the other organization for federation services, not the AD FS servers
    
• You are unable to sign into the SharePoint server from a non-domain joined workstation
  • Verify that you can resolve both the federation metadata URL as well as the SharePoint portal using DNS
    
  • Verify that the workstation's DNS resolves to the WAP server's IP address not the AD FS server's
    
  • Verify that the workstation trusts the CA that signed the AD FS and SharePoint server's certificates
    

 

1. Log into the CONTOSO domain controller
2. Press Windows+R to bring up the Run dialogue box. Type gpmc.msc then hit Enter.
3. Right click the Default Domain Policy > Edit
4. Expand User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page
5. Double click Site to Zone Assignment List > Enabled > Show
6. For Value Name enter: contoso.com and for Value enter 1 then click OK > OK

1. Log into the CONTOSO domain controller
2. Press Windows+R to bring up the Run dialogue box. Type certmgr.msc then hit Enter
3. Expand Trusted Root Certificate Authorities > Certificates and locate the Certificate Authority's public key. The following figure shows the CA's public key in the lab environment
   1. 
4. Right click the public key > All Tasks > Export > Next > Next
5. Give the certificate file a file name then click Next > Finish
6. Log into the domain controller for FABRIKAM and copy the CA's public key from the CONTOSO domain controller to the FABRIKAM domain controller
7. Press Windows+R to bring up the Run dialogue box. Type gpmc.msc then hit Enter.
8. Expand Domains > fabrikam.com > Default Domain Policy > Right Click > Edit
9. Expand Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certificate Authorities
10. Right Click > Import > Next >Browse and locate the exported public key from the CONTOSO CA> Next > Next > Finish
11. Click OK.

1. Log into the AD FS server
2. Open an Elevated PowerShell window and run the following commands:
   1. $SigningCert = (Get-AdfsCertificate -CertificateType Token-Signing).thumbprint
   2. $SigningCert = gci cert:LocalMachine\My | ?{$_.Thumbprint -eq $SigningCert}
   3. Export-Certificate -Cert $SigningCert -FilePath C:\SigningCert.cer
3. Copy the file that was created (C:\SigningCert.cer) to the root of the local SharePoint server's C:\ drive.
4. Open an elevated window of the SharePoint 2013 Management Shell
5. Enter the following command: $SigningCert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\SigningCert.cer")
6. Enter the following command to import the certificate into SharePoint's CA store: New-SPTrustedRootAuthority -Name "ADFS Signing Cert" -Certificate $SigningCert
7. The output should appear similar to the following image:
   1. 
8. Repeat these steps for the AD FS server and SharePoint server in the other forest.

1. Log into CONTOSO's AD FS server.
2. Open the AD FS Management Console
3. Expand Trust Relationships > Relying Party Trusts
4. Right Click > Add Relying Party Trust > Start
5. Select "Enter data about the relying party trust manually" then click Next
6. For the Display Name enter "SharePoint 2013" > Click Next
7. Select AD FS Profile > Next > Next
8. Select "Enable Support for the WS-Federation Passive protocol"
9. Enter the following URL: https://www.contoso.com/_trust
10. Click Next > Next > Permit all users to access this relying party > Next > Close
11.  Click Add Rule at the Edit Claim Rules dialogue box.
12. Select Send LDAP Attributes as Claims then click Next
13. Enter "Active Directory" for the claim rule name then select Active Directory for the Attribute Store
14. Select Email Addresses for the LDAP attribute and Email Address for the Outgoing Claim Type then click Finish
15. Click Add Rule > Select Pass Through or Filter an Incoming Claim > Click Next
16. Enter "Federated Users" as the Claim rule name
17. For the Incoming claim Type select Email Address
18. Select Pass through all claim values
19. Click Finish > OK

1. Log into the domain controller for each forest
2. Press Windows+R to bring up the Run dialogue.
3. Type dnsmgmt.msc
4. Right click the DNS server > Properties
5. Click Forwarders > Edit
6. Enter 192.168.30.40 > OK > OK
7. Repeat these steps for the other forest
8. Verify that you can resolve www.fabrikam.com from the CONTOSO domain controller and www.contoso.com from the FABRIKAM domain controller

1. Log into CONTOSO's AD FS server.
2. Open the AD FS Management console
3. Expand Trust Relationships > Claims Provider Trusts
4. Right click > Add Claims Provider Trust
5. Click Start > Select "Import data about the claims provider published online or on a local network"
6. Enter the federation metadata URL for FABRIKAM: https://sts.fabrikam.com/
7. Click Next
8. You should change the display name to FABRIKAM Users. This display name will be the name that is displayed when users arrive at your Web Application proxy and will be displayed if you have more than one claims provider trust configured.
9. Click Next > Close
10. Click Add Rule
11. Select Pass Through or Filter an Incoming Claim > Next
12. Enter "FABRIKAM E-Mail Addresses" for the claim rule name
13. For Incoming claim type enter E-Mail Address
14. Leave "Pass through all claim values" selected then click Finish.
15. You will get a security warning stating you should filter incoming claim values. When first deploying a new claims provider trust I typically leave filtering off until the trust has been verified as working because filtering can greatly complicate the troubleshooting process. However, in a production network you should always filter incoming claims to a specific value such as limiting email claims to just the FABRIKAM mail domain.
16. For the purposes of this lab click Yes > OK

1. Log into FABRIKAM's AD FS server.
2. Open the AD FS Management console
3. Expand Trust Relationships > Claims Provider Trusts
4. Right click > Add Claims Provider Trust
5. Click Start > Select "Import data about the claims provider published online or on a local network"
6. Enter the federation metadata URL for CONTOSO: https://sts.contoso.com/
7. Click Next
8. You should change the display name to CONTOSO Users. This display name will be the name that is displayed when users arrive at your Web Application proxy and will be displayed if you have more than one claims provider trust configured.
9. Click Next > Close
10. Click Add Rule
11. Select Pass Through or Filter an Incoming Claim > Next
12. Enter "CONTOSO E-Mail Addresses" for the claim rule name
13. For Incoming claim type enter E-Mail Address
14. Leave "Pass through all claim values" selected then click Finish.
15. You will get a security warning stating you should filter incoming claim values. When first deploying a new claims provider trust I typically leave filtering off until the trust has been verified as working because filtering can greatly complicate the troubleshooting process. However, in a production network you should always filter incoming claims to a specific value such as limiting email claims to just the CONTOSO mail domain.
16. For the purposes of this lab click Yes > OK

1. Log into CONTOSO's AD FS server.
2. Open the AD FS Management Console
3. Expand Trust Relationships > Relying Party Trusts
4. Right click > Add Relying Party Trust
5. Click Start > Select "Import data about the claims provider published online or on a local network"
6. Enter https://sts.fabrikam.com/ for the federation metadata address
7. Click Next > Next
8. You should change the display name to FABRIKAM Users. This display name will be the name that is displayed when users arrive at your Web Application proxy and will be displayed if you have more than one relying party trust configured.
9. Click Next > Next > Select "Permit all users to access this relying party" > Next > Next > Close
10. Right click the new Relying Party Trust > Edit Claim Rules > Add Rule
11. Select "Send LDAP Attributes as Claims" > Next
12. Enter "Active Directory" for the Claim rule name
13. Select Active Directory for the Attribute Store
14. Under the LDAP Attribute select E-Mail-Addresses and under the Outgoing Claim Type select E-Mail Address
15. Click Finish > OK

1. Log into FABRIKAM's AD FS server.
2. Open the AD FS Management Console
3. Expand Trust Relationships > Relying Party Trusts
4. Right click > Add Relying Party Trust
5. Click Start > Select "Import data about the claims provider published online or on a local network"
6. Enter https://sts.contoso.com/ for the federation metadata address
7. Click Next > Next
8. You should change the display name to CONTOSO Users. This display name will be the name that is displayed when users arrive at your Web Application proxy and will be displayed if you have more than one relying party trust configured.
9. Click Next > Next > Select "Permit all users to access this relying party" > Next > Next > Close
10. Right click the new Relying Party Trust > Edit Claim Rules > Add Rule
11. Select "Send LDAP Attributes as Claims" > Next
12. Enter "Active Directory" for the Claim rule name
13. Select Active Directory for the Attribute Store
14. Under the LDAP Attribute select E-Mail-Addresses and under the Outgoing Claim Type select E-Mail Address
15. Click Finish > OK

1. Log into CONTOSO's AD FS server
2. Open an elevated PowerShell window and enter the following commands:
   1. Get-AdfsClaimsProviderTrust -Name "FABRIKAM Users" | Set-AdfsClaimsProviderTrust -EncryptionCertificateRevocationCheck None -SigningCertificateRevocationCheck None
   2. Get-AdfsRelyingPartyTrust -Name "FABRIKAM Users"    | Set-AdfsRelyingPartyTrust -EncryptionCertificateRevocationCheck None -SigningCertificateRevocationCheck None

1. Log into FABRIKAM's AD FS server
2. Open an elevated PowerShell window and enter the following commands:
   1. Get-AdfsClaimsProviderTrust -Name "CONTOSO Users" | Set-AdfsClaimsProviderTrust -EncryptionCertificateRevocationCheck None -SigningCertificateRevocationCheck None
   2. Get-AdfsRelyingPartyTrust -Name "CONTOSO Users"    | Set-AdfsRelyingPartyTrust -EncryptionCertificateRevocationCheck None -SigningCertificateRevocationCheck None
    

In case you missed it:

Here is Part 1 - Overview

Here is Part 2 - Installing AD DS, AD CS, and DNS Records

Here is Part 3 - Installing SQL Database Services

Here is Part 4a - Installing CONTOSO's SharePoint Services

Here is Part 4b - Installing FABRIKAM's SharePoint Services

Here is Part 5a - Installing CONTOSO's AD FS Services

Here is Part 5b - Installing FABRIKAM's AD FS Services

Here is Part 6a - Installing CONTOSO's Web Application Proxies

Here is Part 6b - Installing FABRIKAM's Web Application Proxies

Topology

The following topology highlights in yellow the server and 3 workstations that will be built for part 7 and where they fit into the overall topology. If you wish to see the full topology click here

Deploy External DNS Server

For this lab scenario, the external DNS server will be used to host the external DNS records for both CONTOSO and FABRIKAM. In the real world each organization would probably control their own corporate namespace and would create the necessary records in their externally accessible DNS zones. For this lab environment, EX-DNS-01 will serve the role of root DNS server and will contain A records that help external clients locate each organization's federation services and web services.

This section will deploy the external DNS server.

1. Deploy a Windows Server 2012 R2 workgroup server and configure the IP addess, subnet mask, DNS Server, and hostname. For the purposes of this series the information will be as follows:
   1. Hostname: EX-DNS-01
   2. IP Address: 192.168.30.40
   3. Subnet Mask: 255.255.255.0
   4. DNS Server: 192.168.30.40
      
2. Add the DNS Server role to the server by typing the following command from an elevated PowerShell window:
   1. Add-WindowsFeature DNS,RSAT-DNS-Server -IncludeManagementTools
3. Create a new root DNS zone by typing the following command from an elevated PowerShell window:
   1. Add-DnsServerPrimaryZone -Name . -ZoneFile root.dns  I made this line bold to ensure you see that the zone's name is a dot. Ensure you include the dot to create a new root DNS zone.

Add DNS records to the root zone using the following commands:

1. Add-DnsServerResourceRecordA -ZoneName . -Name  www.contoso.com -IPV4Address 192.168.30.4
   
2. Add-DnsServerResourceRecordA -ZoneName . -Name sts.contoso.com    -IPV4Address 192.168.30.10
3. Add-DnsServerResourceRecordA -ZoneName . -Name www.fabrikam.com -IPV4Address 192.168.30.22
4. Add-DnsServerResourceRecordA -ZoneName . -Name sts.fabrikam.com   -IPV4Address 192.168.30.28
   

It is very important to note that the federation DNS records point to the IP address of the WAP, NOT the ADFS servers within the external DNS. IN a production environment, the ADFS servers will typically be behind a firewall and are completely inaccessible from the Extranet.

Validation

You can validate that the zone and records were properly created by opening the dnsmgmt.msc console and expanding the root DNS zone. The zone should appear as shown in the following figure.

 Deploy WORKGROUP Workstation

To demonstrate use cases in a mobility environment or a bring your own device environment where users are not domain joined or need to access services while outside of the corporate network, create a Windows 8 or Windows 10 workstation that is not domain joined and configure it with the following configuration:

• Hostname: EX-WK-01
• IP Address: 192.168.30.41
  
• Subnet Mask: 255.255.255.0
  
• DNS Server: 192.168.30.40
  

Export the public keys for the Certificate Authorities from the FABRIKAM domain and from the CONTOSO domain and import them into the workstation's trusted root CA store.

From the workstation you should be able to open the following URLs:

• https://www.contoso.com
• https://sts.contoso.com/federationmetadata/2007-06/federationmetadata.xml
  
• https://www.fabrikam.com
  
• https://sts.fabrikam.com/federationmetadata/2007-06/federationmetadata.xml
  

If you get certificate errors opening any of the URLs ensure you imported the public keys for the CONTOSO and FABRIKAM CAs into the Trusted Root Certificate Authority Store of the workstation.

Deploy CONTOSO Workstation

For this client I am going to use a Windows 10 Professional client since Windows 10 Pro is now available.  Create a Windows 10 or Windows 8 workstation and configure it using the following configuration:

• Hostname: CONT-WK01
• IP Address: 192.168.30.15
  
• Subnet Mask: 255.255.255.0
  
• DNS Server: 192.168.30.2
  

Join the new workstation to the contoso.com domain.

Deploy FABRIKAM Workstation

For this client I am going to use a Windows 10 Professional client since Windows 10 Pro is now available.  Create a Windows 10 or Windows 8 workstation and configure it using the following configuration:

• Hostname: FABR-WK01
• IP Address: 192.168.30.35
  
• Subnet Mask: 255.255.255.0
  
• DNS Server: 192.168.30.20

Join the new workstation to the fabrikam.com domain.

Wrap-Up

You now have two forests, external DNS, certificate services, database services, web services, AD FS services, and Web Application Proxies. The only remaining steps are to start configuring the AD FS trusts and certificates so that SharePoint accepts the claims issued by the AD FS servers and so that each organization trusts the claims issued by the other organization.

In case you missed it:

Here is Part 1 - Overview

Here is Part 2 - Installing AD DS, AD CS, and DNS Records

Here is Part 3 - Installing SQL Database Services

Here is Part 4a - Installing CONTOSO's SharePoint Services

Here is Part 4b - Installing FABRIKAM's SharePoint Services

Here is Part 5a - Installing CONTOSO's AD FS Services

Here is Part 5b - Installing FABRIKAM's AD FS Services

Here is Part 6a - Installing CONTOSO's Web Application Proxies

Topology

The following topology highlights in yellow the four servers that will be built for parts 6a and 6b and where they fit into the overall topology. If you wish to see the full topology click here

Deploy FABRIKAM's First Web Application Proxy (WAP) Server

 This section will deploy FABRIKAM's first Web Application Proxy server.

1. Deploy a Windows Server 2012 R2 workgroup server and configure the IP addess, subnet mask, hostname, and DNS servers. For the purposes of this series the information will be as follows:
   1. Hostname: FABR-WAP01
   2. IP Address: 192.168.30.26
   3. Subnet Mask: 255.255.255.0
   4. DNS Servers: 192.168.30.20
2. Join the fabrikam.com domain
3. After rebooting, log into the server using FABRIKAM domain credentials (i.e. FABRIKAM\Administrator)
4. Add the WAP role to the server by typing the following command from an elevated PowerShell window:
   1. Add-WindowsFeature -Name Web-Application-Proxy -IncludeManagementTools
      
5. Request a certificate for the WAP
   1. From the Start Menu type MMC > File > Add/Remove Snapin > Certificates > Add > Computer Account
   2. Click Next > Finish > OK
      
   3. Expand Certificates > Right Click Personal > All Tasks > Request New Certificate
      
   4. Click Next, ensure Active Directory Enrollment Policy is highlighted > Next
      
   5. Select Web Server then click the More Information is required link
      
   6. For the subject name select Common Name then type sts.fabrikam.com  and click Add
      
   7. Click the General tab and enter sts.fabrikam.com for the Friendly name and Description
      
   8. Click the Private Key tab
      
   9. Select Key Options > Make private key exportable then click OK > Enroll
6. Get the certificate thumbprint of the WAP's certificate by typing the following commands:
   1. dir cert:localmachine/my
7. Copy the cert thumbprint to Notepad or the clipboard then type the following command to connect the Web Application Proxy to the ADFS servers
   1. Install-WebApplicationProxy -CertificateThumbprint <thumbprint> -FederationServiceName sts.fabrikam.com
      
8. Enter a username and password with administrative rights on the Federation Service servers then click OK.
9. You should get a success message that the deployment succeeded as shown in the following Figure.
   1. 
10. Before proceeding I recommend that you edit your hosts file on a server other than FABR-WAP01 to point sts.fabrikam.com to the IP address of FABR-WAP01 then verify that you are able to view the federation metadata by going to the following URL: https://sts.fabrikam.com/federationmetadata/2007-06/federationmetadata.xml. This will ensure the WAP is properly publishing the metadata before proceeding.

Deploy FABRIKAM's Second Web Application Proxy (WAP) Server

This section will deploy FABRIKAM's Second Web Application Proxy server to support a  highly available configuration.

1. Deploy a Windows Server 2012 R2 workgroup server and configure the IP addess, subnet mask, hostname, and DNS servers. For the purposes of this series the information will be as follows:
   1. Hostname: FABR-WAP02
   2. IP Address: 192.168.30.27
   3. Subnet Mask: 255.255.255.0
   4. DNS Servers: 192.168.30.20
2. Join the fabrikam.com domain
3. After rebooting, log into the server using FABRIKAM domain credentials (i.e. FABRIKAM\Administrator)
4. Add the WAP role to the server by typing the following command from an elevated PowerShell window:
   1. Add-WindowsFeature -Name Web-Application-Proxy -IncludeManagementTools
      
5. Export the public and private key of the certificate that was requested for FABR-WAP01 and import the certificate to FABR-WAP02's personal computer store.
6.  Get the certificate thumbprint of the WAP's certificate by typing the following commands:
   
   1. dir cert:localmachine/my
      
7. Copy the cert thumbprint to Notepad or the clipboard then type the following command to connect the Web Application Proxy to the ADFS server:
   1. Install-WebApplicationProxy -CertificateThumbprint <thumbprint> -FederationServiceName sts.fabrikam.com
      
8. Enter a username and password with administrative rights on the Federation Service servers then click OK.
   
9. You should get a success message that the deployment succeeded as shown in the following Figure.
   1. 
      
10. Before proceeding I recommend that you edit your hosts file on a server other than the FABR-WAP02 to point sts.fabrikam.com to the IP address of FABR-WAP02 then verify that you are able to view the federation metadata by going to the following URL: https://sts.fabrikam.com/federationmetadata/2007-06/federationmetadata.xml. This will ensure the WAP is properly publishing the metadata before proceeding.

Install Windows NLB (OPTIONAL)

The following steps will make the WAP deployment a highly available service. Typically in a production environment, a 3rd party load balancer is used to provide this functionality. If you choose to skip the deployment of Windows NLB or a 3rd party load balancer ensure to change the external sts.fabrikam.com DNS A record IP address to point to either FABR-WAP01 or FABR-WAP02.

Deploy NLB to FABR-WAP01

1. Log into FABR-WAP01 and open an elevated PowerShell window
2.  Type the following commands to add NLB to FABR-WAP01 and to configure the port rules
   
   1. Add-WindowsFeature NLB,RSAT-NLB -IncludeManagementTools
      
   2. New-NlbCluster -Hostname FABR-WAP01 -Interface "Ethernet" -ClusterName WAPNLB -ClusterPrimaryIP 192.168.30.28 -SubnetMask 255.255.255.0 -OperationMode Multicast. Note: if you are unsure of the Inteface name or this command fails type Get-NetAdapter | fl name to get the interface name
      
   3. Get-NlbClusterPortRule | Remove-NlbClusterPortRule -Force
      
   4. Add-NlbClusterPortRule -StartPort 443 -EndPort 443 -IP 192.168.30.28 -Protocol Tcp -Affinity Single -Interface "Ethernet"
      
   5. Add-NlbClusterPortRule -StartPort 49443 -EndPort 49443 -IP 192.168.30.28 -Protocol Tcp -Affinity Single -Interface "Ethernet"
   6. Verify that the cluster is operational by typing the following command: Get-NlbCluster
      

Deploy NLB to FABR-WAP02

1. Log into FABR-WAP02 and open an elevated PowerShell window
2. Type the following commands to add NLB to FABR-WAP02
   
   1. Add-WindowsFeature NLB,RSAT-NLB -IncludeManagementTools
   2. Add-NlbClusterNode -NewNodeName FABR-WAP02 -NewNodeInterface "Ethernet" -Hostname FABR-WAP01 -Interface "Ethernet"
   3. Verify that the cluster is fully converged by typing the following command: Get-NlbCluster

Verify NLB and AD FS Federation Metadata

Verify NLB is fully configured by going to the start screen > type network load balancing manager then press enter. NLB should show that it is fully converged.

Verify AD FS by editing the hosts file of one of the servers to point sts.fabrikam.com to the NLB virtual IP address then by typing the following URL into a browser window: https://sts.fabrikam.com/FederationMetadata/2007-06/FederationMetadata.xml. The federation metadata should display.

If you chose to deploy NLB or a 3rd party loadbalancer, ensure both nodes work as intended before proceeding by drainstopping one of the nodes (Powershell: Stop-NlbClusterNode -Drain -Hostname FABR-WAP01 or FABR-WAP02). A common problem I have seen when dealing with clustering is that only one node works so users get intermittent errors that can be hard to troubleshoot since traffic occasionally hits the non-working node.

If your environment is virtual and your hypervisor host is Hyper-V and the NLB VIP is unreachable outside of the NLB cluster's VLAN or you encounter intermittent connectivity problems to the VIP then try enabling MAC spoofing for the VM as explained here. If your hypervisor is VMware, you may need a static mapped mac address entry to resolve the issue.

Wrap-Up

You now have two forests one named contoso.com and one named fabrikam.com along with the DNS records, certificate services, database services, CONTOSO's and FABRIKAM's SharePoint Foundation 2013 services, and CONTOSO's and FABRIKAM's Windows Server 2012 R2 AD FS services, and CONTOSO's and FABRIKAM's Web Application Proxy services.. In the upcoming parts,external DNS will be configured, a bi-directional AD FS trust will be established, and different login scenarios will be demonstrated.

Troubleshooting

1. If the WAP's federation metadata does not display, ensure the WAP's service is started: Get-Service appproxy* | fl name,status
2. If the WAP fails to connect to the ADFS servers, verify that the WAP can properly resolve the service name of the ADFS service running on the ADFS servers (i.e. sts.fabrikam.com)
   
3. If the WAP is in a workgroup, ensure the WAP trusts the CA that signed the ADFS Service's Service Communications certificate.

I recently was working with a script that had very specific requirements:

1. The script had to run as a scheduled task
2. The scheduled task itself had to be created using PowerShell
3. The script had to run once the servers started up
4. The task had to repeat every 10 minutes for 1 day

Creating a scheduled task is pretty straight forward and is well documented here. But I quickly discovered that creating a scheduled task with the specific parameters that were needed is not as simple as it might seem. In this blog post I am going to show you how to create a scheduled task using Powershell, call a PowerShell script using that scheduled task, and configure parameters of the scheduled task that are not provided through the PowerShell Scheduled Task cmdlets. So lets go ahead and create an example scheduled task that meets all of the requirements.

Create a Sample Script

First lets create a very basic sample script that the scheduled task will run. The following code simply records the date and time and outputs it to a log file in the same folder as the script.

#Stores Script's Current Location
$sCurrDir = $myinvocation.mycommand.path
$sCurrDir = $sCurrDir.Replace("\" + $myinvocation.MyCommand, "")

#Log Output Path
$OutputPath = "$sCurrDir\SampleScheduledTask.log"

#Outputs to log file
function Write-Log{
param(
    [string]$OutputPath
)

    #Stores Date / Time
    $Date = $TimeStamp = (get-date).toshortdatestring(); $Time = (get-date).tolongtimestring()

    #Creates Output Message
    $Message = "I ran on $Date at $Time"

    #Writes Output Message to log file
    $Message | Add-Content $OutputPath
}
#Calls Log Function
Write-Log -OutputPath $OutputPath

Some astute readers may question why I created a function for such a simple script. The answer is because I like to provide complete examples that will provide you not just the answer to your original questions but also illustrate good coding practices and clarifying concepts that will help you write a more complete script. In this post I am not only going to show you how to automate the creation of a scheduled task and how to modify its advanced parameters, I am also going to create the scheduled task and run an example script all using the same script.

Saving The Script

Now that we have the start of the sample script it is important to save it in the following location for the purposes of this example:

           C:\SampleScheduledTaskScript

Create a folder with that path and save the script in the folder with the name:

          SampleScheduledTaskScript.ps1

So the full path to the script should be:

       C:\SampleScheduledTaskScript\SampleScheduledTaskScript.ps1

It is important that this structure and naming convention be followed for the purposes of this example.

Creating The Scheduled Task

At this point we have our sample script, now we just need it to run as a scheduled task.  So lets create the scheduled task:

We want the script to run regardless of the current execution policy, so we create the following task action:

#Creates Scheduled Task Action
$TaskAction1 = New-ScheduledTaskAction -Execute 'PowerShell.exe' -Argument "-ExecutionPolicy Bypass -File ""C:\SampleScheduledTaskScript\SampleScheduledTaskScript.ps1""

Next we want the scheduled task to run as system so we create the following Task Principal:

#Assigns Task Principal
$TaskUserName = New-ScheduledTaskPrincipal -UserID "NT AUTHORITY\SYSTEM" -LogonType ServiceAccount -RunLevel Highest

The scheduled task must run at startup so we create the following entry:

#Task Trigger
$TaskTrigger  = New-ScheduledTaskTrigger -AtStartup

Next we create the scheduled task:

#Create Scheduled Task
$Task = New-ScheduledTask -Action $TaskAction1 -Principal $TaskUserName -Trigger $TaskTrigger -Settings $TaskSettings 

And lastly we register the scheduled task

#Register Scheduled Task
Register-ScheduledTask SampleScheduledTask -InputObject $Task -Force

The Missing Parameters

Great, so now we have a script, a scheduled task that runs the script, and it will run every time the server or workstation is started up. But we have failed to meet one of the requirements; the task must also repeat every 10 minutes for 1 day. If you go back and attempt to add a repetition interval or repetition duration you will notice that neither are an option for the -AtStartup parameter:

Through the GUI the scheduled task parameters are available:

But they are not available via the PowerShell New-ScheduledTaskTrigger cmdlet if you choose the -AtStartup parameter. They are available via the -Once parameter but that would not meet the requirements. The solution is to directly modify the task's properties using its XML schema. This may sound complicated at first but in reality it is very easy and will allow you to modify practically every parameter of the scheduled task.

Step 1  - Get the scheduled task. The first step is to get the scheduled task that you just created and store it in an object.

$Task = Get-ScheduledTask -TaskName "SampleScheduledTask"

Step 2 - Update the specific property of the task that you wish to modify. For this example we wish to add a repetition duration and a repetition interval.

$Task.Triggers.Repetition.Duration = "P1D"
$Task.Triggers.Repetition.Interval = "PT10M"

You are probably wondering how I knew P1D would equal a duration of 1 Day and how I knew PT10M would equal a repetition interval of 10 minutes since neither are the typical date/time or timespan values that you are probably used to working with. To get those values I simply configured the duration and interval that I wanted through the GUI then viewed the result through Powershell  using the following command: $Task.Triggers.Repetition | fl *

Step 3 - Save the new configuration to the scheduled task. Remember, you must re-enter the credentials for the task here or the operation will fail.

$Task | Set-ScheduledTask -User "NT AUTHORITY\SYSTEM"

Validation

The scheduled task should now meet all of the requirements; lets validate that it does indeed run at startup and repeat every 10 minutes for a day. You can either validate through PowerShell or through the GUI, lets do both:

PowerShell

$Task = Get-ScheduledTask -TaskName "SampleScheduledTask"

$Task.Triggers.Repetition | fl *

As you can see in the following image, the scheduled task's Repetition parameters have the values you provided.

The GUI

As you can see in the following image, the GUI shows that the desired duration and repetition are properly configured.

Wrap Up

In this post I have shown you how to create a scheduled task that will run a PowerShell script and how to modify parameters of the scheduled task that are not available through the Scheduled Tasks PowerShell cmdlets. Using this process you can easily modify practically every parameter of a scheduled task.

BONUS

Attached to this post is a script that will create the scheduled task for you, then run itself every 10 minutes for one day at startup. The usual caveats apply; the script is for demonstration purposes only and do not forget to delete the sample scheduled task that it creates when you are done. To run the attached script, rename it from .txt to .ps1. The script must be placed in a folder called C:\SampleScheduledTaskScript in order to properly run the scheduled task.

SampleScheduledTaskScript.txt

In case you missed it:

Here is Part 1 - Overview

Here is Part 2 - Installing AD DS, AD CS, and DNS Records

Here is Part 3 - Installing SQL Database Services

Here is Part 4a - Installing CONTOSO's SharePoint Services

Here is Part 4b - Installing FABRIKAM's SharePoint Services

Here is Part 5a - Installing CONTOSO's AD FS Services

Here is Part 5b - Installing FABRIKAM's AD FS Services

Topology

The following topology highlights in yellow the four servers that will be built for parts 6a and 6b and where they fit into the overall topology. If you wish to see the full topology click here

Deploy CONTOSO's First Web Application Proxy (WAP) Server

This section will deploy CONTOSO's first Web Application Proxy server.

1. Deploy a Windows Server 2012 R2 workgroup server and configure the IP addess, subnet mask, hostname, and DNS servers. For the purposes of this series the information will be as follows:
   1. Hostname: CONT-WAP01
   2. IP Address: 192.168.30.8
   3. Subnet Mask: 255.255.255.0
   4. DNS Servers: 192.168.30.2
2. Join the contoso.com domain
3. After rebooting, log into the server using CONTOSO domain credentials (i.e. CONTOSO\Administrator)
4. Add the WAP role to the server by typing the following command from an elevated PowerShell window:
   1. Add-WindowsFeature -Name Web-Application-Proxy -IncludeManagementTools
      
5. Request a certificate for the WAP
   
   1. From the Start Menu type MMC > File > Add/Remove Snapin > Certificates > Add > Computer Account
      
   2. Click Next > Finish > OK
      
   3. Expand Certificates > Right Click Personal > All Tasks > Request New Certificate
      
   4. Click Next, ensure Active Directory Enrollment Policy is highlighted > Next
      
   5. Select Web Server then click the More Information is required link
      
   6. For the subject name select Common Name then type sts.contoso.com  and click Add
      
   7. Click the General tab and enter sts.contoso.com for the Friendly name and Description
      
   8. Click the Private Key tab
      
   9. Select Key Options > Make private key exportable then click OK > Enroll
   
   
6.  Get the certificate thumbprint of the WAP's certificate by typing the following commands:
   
   1. dir cert:localmachine/my
      
7. Copy the cert thumbprint to Notepad or the clipboard then type the following command to connect the Web Application Proxy to the ADFS server:
   1. Install-WebApplicationProxy -CertificateThumbprint <thumbprint> -FederationServiceName sts.contoso.com
      
8. Enter a username and password with administrative rights on the Federation Service servers then click OK.
   
9. You should get a success message that the deployment succeeded as shown in the following Figure.
   
   1. 
10. Before proceeding I recommend that you edit your hosts file on a server other than CONT-WAP01 to point sts.contoso.com to the IP address of CONT-WAP01 then verify that you are able to view the federation metadata by going to the following URL: https://sts.contoso.com/federationmetadata/2007-06/federationmetadata.xml. This will ensure the WAP is properly publishing the metadata before proceeding.

Deploy CONTOSO's Second Web Application Proxy (WAP) Server

This section will deploy CONTOSO's Second Web Application Proxy server to support a  highly available configuration.

1. Deploy a Windows Server 2012 R2 workgroup server and configure the IP addess, subnet mask, hostname, and DNS servers. For the purposes of this series the information will be as follows:
   1. Hostname: CONT-WAP02
   2. IP Address: 192.168.30.9
   3. Subnet Mask: 255.255.255.0
   4. DNS Servers: 192.168.30.2
2. Join the contoso.com domain
3. After rebooting, log into the server using CONTOSO domain credentials (i.e. CONTOSO\Administrator)
4. Add the WAP role to the server by typing the following command from an elevated PowerShell window:
   1. Add-WindowsFeature -Name Web-Application-Proxy -IncludeManagementTools
      
5. Export the public and private key of the certificate that was requested for CONT-WAP01 and import the certificate to CONT-WAP02's personal computer store.
6.  Get the certificate thumbprint of the WAP's certificate by typing the following commands:
   
   1. dir cert:localmachine/my
      
7. Copy the cert thumbprint to Notepad or the clipboard then type the following command to connect the Web Application Proxy to the ADFS server:
   1. Install-WebApplicationProxy -CertificateThumbprint <thumbprint> -FederationServiceName sts.contoso.com
      
8. Enter a username and password with administrative rights on the Federation Service servers then click OK.
   
9. You should get a success message that the deployment succeeded as shown in the following Figure.
   
   1. 
10. Before proceeding I recommend that you edit your hosts file on a server other than the CONT-WAP02 to point sts.contoso.com to the IP address of CONT-WAP02 then verify that you are able to view the federation metadata by going to the following URL: https://sts.contoso.com/federationmetadata/2007-06/federationmetadata.xml. This will ensure the WAP is properly publishing the metadata before proceeding.

Install Windows NLB (OPTIONAL)

The following steps will make the WAP deployment a highly available service. Typically in a production environment, a 3rd party load balancer is used to provide this functionality. If you choose to skip the deployment of Windows NLB or a 3rd party load balancer ensure to change the external sts.contoso.com DNS A record IP address to point to either CONT-WAP01 or CONT-WAP02.

Deploy NLB to CONT-WAP01

1. Log into CONT-WAP01 and open an elevated PowerShell window
2.  Type the following commands to add NLB to CONT-WAP01 and to configure the port rules
   
   1. Add-WindowsFeature NLB,RSAT-NLB -IncludeManagementTools
      
   2. New-NlbCluster -Hostname CONT-WAP01 -Interface "Ethernet" -ClusterName WAPNLB -ClusterPrimaryIP 192.168.30.10 -SubnetMask 255.255.255.0 -OperationMode Multicast. Note: if you are unsure of the Inteface name or this command fails type Get-NetAdapter | fl name to get the interface name
      
   3. Get-NlbClusterPortRule | Remove-NlbClusterPortRule -Force
      
   4. Add-NlbClusterPortRule -StartPort 443 -EndPort 443 -IP 192.168.30.10 -Protocol Tcp -Affinity Single -Interface "Ethernet"
      
   5. Add-NlbClusterPortRule -StartPort 49443 -EndPort 49443 -IP 192.168.30.10 -Protocol Tcp -Affinity Single -Interface "Ethernet"
   6. Verify that the cluster is operational by typing the following command: Get-NlbCluster
      

Deploy NLB to CONT-WAP02

1. Log into CONT-WAP02 and open an elevated PowerShell window
2. Type the following commands to add NLB to CONT-WAP02
   
   1. Add-WindowsFeature NLB,RSAT-NLB -IncludeManagementTools
   2. Add-NlbClusterNode -NewNodeName CONT-WAP02 -NewNodeInterface "Ethernet" -Hostname CONT-WAP01 -Interface "Ethernet"
   3. Verify that the cluster is fully converged by typing the following command: Get-NlbCluster

Verify NLB and AD FS Federation Metadata

 Verify NLB is fully configured by going to the start screen > type network load balancing manager then press enter. NLB should show that it is fully converged.

Verify AD FS by editing the hosts file of one of the servers to point sts.contoso.com to the NLB virtual IP address then by typing the following URL into a browser window: https://sts.contoso.com/FederationMetadata/2007-06/FederationMetadata.xml. The federation metadata should display.

If you chose to deploy NLB or a 3rd party loadbalancer, ensure both nodes work as intended before proceeding by drainstopping one of the nodes (Powershell: Stop-NlbClusterNode -Drain -Hostname CONT-WAP01 or CONT-WAP02). A common problem I have seen when dealing with clustering is that only one node works so users get intermittent errors that can be hard to troubleshoot since traffic occasionally hits the non-working node.

If your environment is virtual and your hypervisor host is Hyper-V and the NLB VIP is unreachable outside of the NLB cluster's VLAN or you encounter intermittent connectivity problems to the VIP then try enabling MAC spoofing for the VM as explained here. If your hypervisor is VMware, you may need a static mapped mac address entry to resolve the issue.

Wrap-Up

You now have two forests one named contoso.com and one named fabrikam.com along with the DNS records, certificate services, database services, CONTOSO's and FABRIKAM's SharePoint Foundation 2013 services, and CONTOSO's and FABRIKAM's Windows Server 2012 R2 AD FS services, and CONTOSO's Web Application Proxy services.. In the upcoming parts FABRIKAM's Web Application Proxies will be deployed and configured to support federated web SSO, a bi-directional AD FS trust will be established, external DNS will be configured, and different login scenarios will be tested.

Troubleshooting

• If the WAP's federation metadata does not display, ensure the WAP's service is started: Get-Service appproxy* | fl name,status
• If the WAP fails to connect to the ADFS servers, verify that the WAP can properly resolve the service name of the ADFS service running on the ADFS servers (i.e. sts.contoso.com)
  
• If the WAP is in a workgroup, ensure the WAP trusts the CA that signed the ADFS Service's Service Communications certificate.

In case you missed it:

Here is Part 1 - Overview

Here is Part 2 - Installing AD DS, AD CS, and DNS Records

Here is Part 3 - Installing SQL Database Services

Here is Part 4a - Installing CONTOSO's SharePoint Services

Here is Part 4b - Installing FABRIKAM's SharePoint Services

Here is Part 5a - Installing CONTOSO's AD FS Services

Topology

The following topology highlights in yellow the two servers that will be built for parts 5a and 5b and where they fit into the overall topology. If you wish to see the full topology click here

Deploy FABRIKAM's Federation Servers

The following sections will deploy FABRIKAM's federation servers in a highly available configuration. 

Deploy FABRIKAM's First Federation Server

1. Log into the FABRIKAM domain controller (FABR-DC01) and create a new Domain User called srv_ADFS
2. If you have not already done so, create a new DNS A record called sts.fabrikam.com with an IP address of 192.168.30.25 which is the network loadbalanced virtual IP address for the federation service.
3. Log into the FABRIKAM SQL server (FABR-SQ01) and give srv_ADFS sysadmin rights.
   1. Open SQL Server Management studio > Security > Logins > New Login > Search > Locations > Entire Directory > OK
   2. Enter srv_adfs then press Enter
      
   3. Select Server Roles > Check sysadmin > OK
   4. In a production environment the rights should be modified to give the service account the least permissions necessary after AD FS is deployed.

4. Deploy a Windows Server 2012 R2 workgroup server and configure the IP addess, subnet mask, hostname, and DNS servers. For the purposes of this series the information will be as follows:
   1. Hostname: FABR-FS01
   2. IP Address: 192.168.30.23
   3. Subnet Mask: 255.255.255.0
   4. DNS Servers: 192.168.30.20
5. Join the fabrikam.com domain
6. After rebooting, log into the server using FABRIKAM domain credentials (i.e. FABRIKAM\Administrator)
7. Add AD FS to the server by typing the following command from an elevated PowerShell window: Add-WindowsFeature ADFS-Federation -Includemanagementtools
   
8. Request 3 certificates (Service Communications, Decryption, Signing)
   
   1. From the Start Menu type MMC > File > Add/Remove Snapin > Certificates > Add > Computer Account
      
   2. Click Next > Finish > OK
      
   3. Expand Certificates > Right Click Personal > All Tasks > Request New Certificate
      
   4. Click Next, ensure Active Directory Enrollment Policy is highlighted > Next
      
   5. Select Web Server then click the More Information is required link
      
   6. For the subject name select Common Name then type sts.fabrikam.com  and click Add
      
   7. Click the General tab and enter sts.fabrikam.com for the Friendly name and Description
      
   8. Click the Private Key tab
      
   9. Select Make private key exportable then click OK > Enroll
      
   10. Repeat steps 7a-7i to obtain 2 more certs with a subject name of sts-dec.fabrikam.com and sts-sig.fabrikam.com
       
9. The service communications certificate should have a subject name of sts.fabrikam.com, the decryption certificate should have a subject name of sts-dec.fabrikam.com, and the signing certificate should have a subject name of sts-sig.fabrikam.com
10. Export all of the certificates to a PFX file before continuing.
    
    1. Highlight all 3 certificates > Right Click > All Tasks > Export
       
    2. Click Next > Yes, export the private key >  Next > Personal Information Exchange > Next
       
    3. Select Password and enter a password then click Next
       
    4. Select a place to save the file > Next > Finish > OK
       
11. Go back to the certificate management console and give the srv_ADFS service account rights to read the private keys
    
    1. Highlight a Certificate > Right Click > All Tasks > Manage Private Keys > Add > srv_ADFS > Uncheck Full Control
       
    2. Click OK
       
    3. Repeat for all 3 certificates
       
12. Open an elevated PowerShell window and type the following command: dir cert:localmachine\my
    
13. Open Notepad and copy and paste the thumbprints from each certificate to the proper locations within the following command after typing the following PowerShell command into the Notepad document:
    1. $fsCred = Get-Credential
       
    2. Install-AdfsFarm -CertificateThumbprint <thumbprint> -DecryptionCertificateThumbprint <thumbprint> -SigningCertificateThumbprint <thumbprint> -FederationServiceName sts.fabrikam.com -SQLConnectionString "Data Source=FABR-SQ01;Integrated Security=True" -ServiceAccountCredential $fsCred -FederationServiceDisplayName "FABRIKAM Users" 
       
    3. The completed command should look similar to the one shown in the following Figure.
       
    4. 
       
14. Copy the completed PowerShell commands from Notepad to an elevated PowerShell window. Enter FABRIKAM\srv_ADFS and the password for srv_ADFS when prompted then press Enter to continue
    
15. You should get a message stating that the deployment was successful.
    
16. Type the following PowerShell command to verify that the service successfully installed: Test-AdfsFarmInstallation -FederationServiceName sts.fabrikam.com then enter the credentials for FABRIKAM\srv_ADFS when prompted. Your output should be similar to the one shown in the following Figure.
    

Deploy FABRIKAM's Second Federation Server

1. Deploy a Windows Server 2012 R2 workgroup server and configure the IP addess, subnet mask, hostname, and DNS servers. For the purposes of this series the information will be as follows:
   1. Hostname: FABR-FS02
   2. IP Address: 192.168.30.24
   3. Subnet Mask: 255.255.255.0
   4. DNS Servers: 192.168.30.20
2. Join the fabrikam.com domain
3. After rebooting, log into the server using FABRIKAM domain credentials (i.e. FABRIKAM\Administrator)
4. Add AD FS to the server by typing the following command from an elevated PowerShell window: Add-WindowsFeature ADFS-Federation -Includemanagementtools
   
5. Copy the private keys that were exported from FABR-FS01 to FABR-FS02
6. Import the private keys to FABR-FS02
   
   1. Double click the PFX file and select LocalMachine then click Next > Next
   2. Enter the password that you entered when you exported the private keys then click Next
   3. Select Place all certificates in the following store > Browse > Personal > OK > Next > Finish > OK. Note: As a best practice you should delete the PFX file once the certificates have been imported into the certificate store.
7. Open the certificate management console and give the srv_ADFS service account rights to read the private keys
   
   1. Highlight a Certificate > Right Click > All Tasks > Manage Private Keys > Add > srv_ADFS > Uncheck Full Control
      
   2. Click OK
      
   3. Repeat for all 3 certificates
8. Open an elevated PowerShell window and type the following command: dir cert:localmachine\my
9. Open Notepad and copy and paste the service communications thumbprint (subject: sts.fabrikam.com) cto the proper location within the following command after typing the following PowerShell command into the Notepad
   1. $fsCred = Get-Credential
   2. Add-AdfsFarmNode -ServiceAccountCredential $fsCred -SQLConnectionString "Data Source=FABR-SQ01;Integrated Security=True" -CertificateThumbprint "<thumbprint>"
10. The completed command should look similar to the one shown in the following Figure.
    
    1. 
11. You should get a message stating that the deployment was successful.
    
12. Type the following PowerShell command to verify that the service successfully installed: Test-AdfsFarmInstallation -FederationServiceName sts.fabrikam.com then enter the credentials for FABRIKAM\srv_ADFS when prompted. Your output should be similar to the one shown in the following Figure.

Install Windows NLB (OPTIONAL)

The following steps will make the AD FS deployment a highly available service. Typically in a production environment, a 3rd party load balancer is used to provide this functionality. If you choose to skip the deployment of Windows NLB or a 3rd party load balancer ensure to change the sts.fabrikam.com DNS A record IP address to point to either FABR-FS01 or FABR-FS02.

Deploy NLB to FABR-FS01

1. Log into FABR-FS01 and open an elevated PowerShell window
2.  Type the following commands to add NLB to CONT-FS01 and to configure the port rules
   
   1. Add-WindowsFeature NLB,RSAT-NLB -IncludeManagementTools
      
   2. New-NlbCluster -Hostname FABR-FS01 -Interface "Ethernet" -ClusterName ADFSNLB -ClusterPrimaryIP 192.168.30.25 -SubnetMask 255.255.255.0 -OperationMode Multicast. Note: if you are unsure of the Inteface name or this command fails type Get-NetAdapter | fl name to get the interface name
      
   3. Get-NlbClusterPortRule | Remove-NlbClusterPortRule -Force
      
   4. Add-NlbClusterPortRule -StartPort 443 -EndPort 443 -IP 192.168.30.25 -Protocol Tcp -Affinity Single -Interface "Ethernet"
      
   5. Add-NlbClusterPortRule -StartPort 49443 -EndPort 49443 -IP 192.168.30.25 -Protocol Tcp -Affinity Single -Interface "Ethernet"
   6. Verify that the cluster is operational by typing the following command: Get-NlbCluster
      

Deploy NLB to FABR-FS01

1. Log into FABR-FS02 and open an elevated PowerShell window
2. Type the following commands to add NLB to FABR-FS02
   
   1. Add-WindowsFeature NLB,RSAT-NLB -IncludeManagementTools
   2. Add-NlbClusterNode -NewNodeName FABR-FS02 -NewNodeInterface "Ethernet" -Hostname FABR-FS01 -Interface "Ethernet"
   3. Verify that the cluster is fully converged by typing the following command: Get-NlbCluster

Verify NLB and AD FS Federation Metadata

Verify NLB is fully configured by going to the start screen > type network load balancing manager then press enter. NLB should be similar to the one shown in the following Figure.

Verify AD FS by typing the following URL into a browser window: https://sts.fabrikam.com/FederationMetadata/2007-06/FederationMetadata.xml

You should be presented with a federation metadata page similar to one of the ones shown below depending on your browser's trusted sites and compatibility mode configuration.

If you chose to deploy NLB or a 3rd party loadbalancer, ensure both nodes work as intended before proceeding by drainstopping one of the nodes (Powershell: Stop-NlbClusterNode -Drain -Hostname FABR-FS01 or FABR-FS02). A common problem I have seen when dealing with clustering is that only one node works so users get intermittent errors that can be hard to troubleshoot since traffic occasionally hits the non-working node.

If your environment is virtual and your hypervisor host is Hyper-V and the NLB VIP is unreachable outside of the NLB cluster's VLAN or you encounter intermittent connectivity problems to the VIP then try enabling MAC spoofing for the VM as explained here. If your hypervisor is VMware, you may need a static mapped mac address entry to resolve the issue.

Verify Service Principal Name

Although the AD FS service automatically configures the SPN for the AD FS service account, I always like to verify that it is correct before proceeding. This will also ensure that another account does not have the same SPN which will prevent Kerberos from working. The following steps will verify the SPN.

1. Log into a FABRIKAM member server.
2. Open a command prompt and type the following commands
   1. setspn -X
      
   2. setspn -L srv_adfs
      
3. The resulting output should be similar to the output shown in the following Figure. Any duplicates should be resolved before continuing.
   

Wrap-Up

You now have two forests one named contoso.com and one named fabrikam.com along with the DNS records, certificate services, database services, CONTOSO's and FABRIKAM's SharePoint Foundation 2013 services, and CONTOSO's and FABRIKAM's Windows Server 2012 R2 AD FS services. In the upcoming parts both organization's Web Application Proxies will be deployed and configured to support Federated Web SSO.

 Troubleshooting

• If you cannot connect to the SQL server and the Windows Firewall is enabled ensure port TCP 1433 is enabled inbound on the Windows Firewall as per the following instructions.
• If the installation of AD FS fails when connecting to SQL, verify that the service account has at least DB Owner on the SQL server for the target database
• If you get an error when attempting to obtain a certificate ensure that Domain Computers have rights to read the Web Server template
• If you get an error when attempting to obtain a certificate ensure that the CRL has not expired
• If you get an error "Install-AdfsFarm: Parameter set cannot be resolved..." verify that the command and all parameters are properly spelled and that all mandatory parameters are present
• If you get an error stating page cannot be found when viewing https://sts.fabrikam.com/FederationMetadata/2007-06/FederationMetadata.xml verify that the sts.fabrikam.com record was created and points to either the AD FS server IP address or the NLB Virtual IP address (VIP)

If you did skip the previous parts and jumped straight to this one, ensure that you update the IP addresses, DNS names, and SPNs to match your environment. One of the most common problems I encounter when troubleshooting a customer's AD FS deployment is incorrect DNS names or Service Principal Names (SPNs).

In case you missed it:

Here is Part 1 - Overview

Here is Part 2 - Installing AD DS, AD CS, and DNS Records

Here is Part 3 - Installing SQL Database Services

Here is Part 4a - Installing CONTOSO's SharePoint Services

Here is Part 4b - Installing FABRIKAM's SharePoint Services

Topology

The following topology highlights in yellow the two servers that will be built for parts 5a and 5b and where they fit into the overall topology. If you wish to see the full topology click here

Deploy CONTOSO's Federation Servers

The following sections will deploy CONTOSO's federation servers in a highly available configuration. 

Deploy CONTOSO's First Federation Server

1. Log into the CONTOSO domain controller (CONT-DC01) and create a new Domain User called srv_ADFS
2. If you have not already done so, create a new DNS A record called sts.contoso.com with an IP address of 192.168.30.7 which is the network loadbalanced virtual IP address for the federation service.
3. Log into the CONTOSO SQL server (CONT-SQ01) and give srv_ADFS sysadmin rights.
   1. Open SQL Server Management studio > Security > Logins > New Login > Search > Locations > Entire Directory > OK
   2. Enter srv_adfs then press Enter
      
   3. Select Server Roles > Check sysadmin > OK
   4. In a production environment the rights should be modified to give the service account the least permissions necessary after AD FS is deployed.

4. Deploy a Windows Server 2012 R2 workgroup server and configure the IP addess, subnet mask, hostname, and DNS servers. For the purposes of this series the information will be as follows:
   1. Hostname: CONT-FS01
   2. IP Address: 192.168.30.5
   3. Subnet Mask: 255.255.255.0
   4. DNS Servers: 192.168.30.2
5. Join the contoso.com domain
6. After rebooting, log into the server using CONTOSO domain credentials (i.e. CONTOSO\Administrator)
7. Add AD FS to the server by typing the following command from an elevated PowerShell window: Add-WindowsFeature ADFS-Federation -Includemanagementtools
   
8. Request 3 certificates (Service Communications, Decryption, Signing)
   
   1. From the Start Menu type MMC > File > Add/Remove Snapin > Certificates > Add > Computer Account
      
   2. Click Next > Finish > OK
      
   3. Expand Certificates > Right Click Personal > All Tasks > Request New Certificate
      
   4. Click Next, ensure Active Directory Enrollment Policy is highlighted > Next
      
   5. Select Web Server then click the More Information is required link
      
   6. For the subject name select Common Name then type sts.contoso.com  and click Add
      
   7. Click the General tab and enter sts.contoso.com for the Friendly name and Description
      
   8. Click the Private Key tab
      
   9. Select Make private key exportable then click OK > Enroll
      
   10. Repeat steps 7a-7i to obtain 2 more certs with a subject name of sts-dec.contoso.com and sts-sig.contoso.com
       
9. The service communications certificate should have a subject name of sts.contoso.com, the decryption certificate should have a subject name of sts-dec.contoso.com, and the signing certificate should have a subject name of sts-sig.contoso.com
10. Export all of the certificates to a PFX file before continuing.
    
    1. Highlight all 3 certificates > Right Click > All Tasks > Export
       
    2. Click Next > Yes, export the private key >  Next > Personal Information Exchange > Next
       
    3. Select Password and enter a password then click Next
       
    4. Select a place to save the file > Next > Finish > OK
       
11. Go back to the certificate management console and give the srv_ADFS service account rights to read the private keys
    
    1. Highlight a Certificate > Right Click > All Tasks > Manage Private Keys > Add > srv_ADFS > Uncheck Full Control
       
    2. Click OK
       
    3. Repeat for all 3 certificates
       
12. Open an elevated PowerShell window and type the following command: dir cert:localmachine\my
    
13. Open Notepad and copy and paste the thumbprints from each certificate to the proper locations within the following command after typing the following PowerShell command into the Notepad document:
    1. $fsCred = Get-Credential
       
    2. Install-AdfsFarm -CertificateThumbprint <thumbprint> -DecryptionCertificateThumbprint <thumbprint> -SigningCertificateThumbprint <thumbprint> -FederationServiceName sts.contoso.com -SQLConnectionString "Data Source=CONT-SQ01;Integrated Security=True" -ServiceAccountCredential $fsCred -FederationServiceDisplayName "CONTOSO Users" 
       
    3. The completed command should look similar to the one shown in the following Figure.
       
    4. 
       
14. Copy the completed PowerShell commands from Notepad to an elevated PowerShell window. Enter CONTOSO\srv_ADFS and the password for srv_ADFS when prompted then press Enter to continue
    
15. You should get a message stating that the deployment was successful.
    
16. Type the following PowerShell command to verify that the service successfully installed: Test-AdfsFarmInstallation -FederationServiceName sts.contoso.com then enter the credentials for CONTOSO\srv_ADFS when prompted. Your output should be similar to the one shown in the following Figure.
    

Deploy CONTOSO's Second Federation Server

1. Deploy a Windows Server 2012 R2 workgroup server and configure the IP addess, subnet mask, hostname, and DNS servers. For the purposes of this series the information will be as follows:
   1. Hostname: CONT-FS02
   2. IP Address: 192.168.30.6
   3. Subnet Mask: 255.255.255.0
   4. DNS Servers: 192.168.30.2
2. Join the contoso.com domain
3. After rebooting, log into the server using CONTOSO domain credentials (i.e. CONTOSO\Administrator)
4. Add AD FS to the server by typing the following command from an elevated PowerShell window: Add-WindowsFeature ADFS-Federation -Includemanagementtools
   
5. Copy the private keys that were exported from CONT-FS01 to CONT-FS02
6. Import the private keys to CONT-FS02
   
   1. Double click the PFX file and select LocalMachine then click Next > Next
   2. Enter the password that you entered when you exported the private keys then click Next
   3. Select Place all certificates in the following store > Browse > Personal > OK > Next > Finish > OK. Note: As a best practice you should delete the PFX file once the certificates have been imported into the certificate store.
7. Open the certificate management console and give the srv_ADFS service account rights to read the private keys
   
   1. Highlight a Certificate > Right Click > All Tasks > Manage Private Keys > Add > srv_ADFS > Uncheck Full Control
      
   2. Click OK
      
   3. Repeat for all 3 certificates
8. Open an elevated PowerShell window and type the following command: dir cert:localmachine\my
9. Open Notepad and copy and paste the service communications thumbprint (subject: sts.contoso.com) to the proper location within the following command after typing the following PowerShell command into the Notepad
   
   1. $fsCred = Get-Credential
   2. Add-AdfsFarmNode -ServiceAccountCredential $fsCred -SQLConnectionString "Data Source=CONT-SQ01;Integrated Security=True" -CertificateThumbprint "<thumbprint>"
10. The completed command should look similar to the one shown in the following Figure.
    
    1. 
11. You should get a message stating that the deployment was successful.
    
12. Type the following PowerShell command to verify that the service successfully installed: Test-AdfsFarmInstallation -FederationServiceName sts.contoso.com then enter the credentials for CONTOSO\srv_ADFS when prompted. Your output should be similar to the one shown in the following Figure.

 Install Windows NLB (OPTIONAL)

The following steps will make the AD FS deployment a highly available service. Typically in a production environment, a 3rd party load balancer is used to provide this functionality. If you choose to skip the deployment of Windows NLB or a 3rd party load balancer ensure to change the sts.contoso.com DNS A record IP address to point to either CONT-FS01 or CONT-FS02.

Deploy NLB to CONT-FS01

1. Log into CONT-FS01 and open an elevated PowerShell window
2.  Type the following commands to add NLB to CONT-FS01 and to configure the port rules
   
   1. Add-WindowsFeature NLB,RSAT-NLB -IncludeManagementTools
      
   2. New-NlbCluster -Hostname CONT-FS01 -Interface "Ethernet" -ClusterName ADFSNLB -ClusterPrimaryIP 192.168.30.7 -SubnetMask 255.255.255.0 -OperationMode Multicast. Note: if you are unsure of the Inteface name or this command fails type Get-NetAdapter | fl name to get the interface name
      
   3. Get-NlbClusterPortRule | Remove-NlbClusterPortRule -Force
      
   4. Add-NlbClusterPortRule -StartPort 443 -EndPort 443 -IP 192.168.30.7 -Protocol Tcp -Affinity Single -Interface "Ethernet"
      
   5. Add-NlbClusterPortRule -StartPort 49443 -EndPort 49443 -IP 192.168.30.7 -Protocol Tcp -Affinity Single -Interface "Ethernet"
   6. Verify that the cluster is operational by typing the following command: Get-NlbCluster
      

Deploy NLB to CONT-FS01

1. Log into CONT-FS02 and open an elevated PowerShell window
2. Type the following commands to add NLB to CONT-FS02
   
   1. Add-WindowsFeature NLB,RSAT-NLB -IncludeManagementTools
   2. Add-NlbClusterNode -NewNodeName CONT-FS02 -NewNodeInterface "Ethernet" -Hostname CONT-FS01 -Interface "Ethernet"
   3. Verify that the cluster is fully converged by typing the following command: Get-NlbCluster

Verify NLB and AD FS Federation Metadata

Verify NLB is fully configured by going to the start screen > type network load balancing manager then press enter. NLB should be similar to the one shown in the following Figure.

Verify AD FS by typing the following URL into a browser window: https://sts.contoso.com/FederationMetadata/2007-06/FederationMetadata.xml

You should be presented with a federation metadata page similar to one of the ones shown below depending on your browser's trusted sites and compatibility mode configuration.

If you chose to deploy NLB or a 3rd party loadbalancer, ensure both nodes work as intended before proceeding by drainstopping one of the nodes (Powershell: Stop-NlbClusterNode -Drain -Hostname CONT-FS01 or CONT-FS02). A common problem I have seen when dealing with clustering is that only one node works so users get intermittent errors that can be hard to troubleshoot since traffic occasionally hits the non-working node.

If your environment is virtual and your hypervisor host is Hyper-V and the NLB VIP is unreachable outside of the NLB cluster's VLAN or you encounter intermittent connectivity problems to the VIP then try enabling MAC spoofing for the VM as explained here. If your hypervisor is VMware, you may need a static mapped mac address entry to resolve the issue.

Verify Service Principal Name

Although the AD FS service automatically configures the SPN for the AD FS service account, I always like to verify that it is correct before proceeding. This will also ensure that another account does not have the same SPN which will prevent Kerberos from working. The following steps will verify the SPN.

1. Log into a CONTOSO member server.
2. Open a command prompt and type the following commands
   1. setspn -X
      
   2. setspn -L srv_adfs
      
3. The resulting output should be similar to the output shown in the following Figure. Any duplicates should be resolved before continuing.
   

Wrap-Up

You now have two forests one named contoso.com and one named fabrikam.com along with the DNS records, certificate services, database services, CONTOSO's and FABRIKAM's SharePoint Foundation 2013 services, and CONTOSO's Windows Server 2012 R2 AD FS services. In the upcoming parts FABRIKAM's AD FS services and both organization's Web Application Proxies will be deployed and configured to support federated web SSO.

 Troubleshooting

• If you cannot connect to the SQL server and the Windows Firewall is enabled ensure port TCP 1433 is enabled inbound on the Windows Firewall as per the following instructions.
• If the installation of AD FS fails when connecting to SQL, verify that the service account has at least DB Owner on the SQL server for the target database
• If you get an error when attempting to obtain a certificate ensure that Domain Computers have rights to read the Web Server template
• If you get an error when attempting to obtain a certificate ensure that the CRL has not expired
• If you get an error "Install-AdfsFarm: Parameter set cannot be resolved..." verify that the command and all parameters are properly spelled and that all mandatory parameters are present
• If you get an error stating page cannot be found when viewing https://sts.contoso.com/FederationMetadata/2007-06/FederationMetadata.xml verify that the sts.contoso.com record was created and points to either the AD FS server IP address or the NLB Virtual IP address (VIP)

Here is Part 1 - Overview

Here is Part 2 - Installing AD DS, AD CS, and DNS Records

Here is Part 3 - Installing SQL Database Services

Here is Part 4a - Installing CONTOSO's SharePoint Services

Topology

The following topology highlights in yellow the two servers that will be built for parts 4a and 4b and where they fit into the overall topology. If you wish to see the full topology click here.

Deploy FABRIKAM's SharePoint Foundation 2013 SP1 Server

The following steps will deploy SharePoint Foundation 2013 SP1 server. If you are deploying a different version of SharePoint consult the documentation of the version you are installing. IMPORTANT: You must use SharePoint Foundation 2013 with SP1 to successfully install SharePoint Foundation 2013 on Windows Server 2012 R2. You can read more about the hardware and software requirements here.

1. Log into the FABRIKAM domain controller (FABR-DC01) and create a new Domain User called srv_SP.
2. Log into the FABRIKAM SQL server (FABR-SQ01) and give srv_SP sysadmin rights.
   
   1. Open SQL Server Management studio > Security > Logins > New Login > Search > Locations > Entire Directory > OK
   2. Type srv_SP > OK
   3. Select Server Roles > Check sysadmin > OK
   4. In a production environment the rights should be modified to give the service account the least permissions necessary after SharePoint is deployed.
      
3. Deploy a Windows Server 2012 R2 workgroup server and configure the IP addess, subnet mask, hostname, and DNS servers. For the purposes of this series the information will be as follows:
   1. Hostname: FABR-SP01
   2. IP Address: 192.168.30.22
   3. Subnet Mask: 255.255.255.0
   4. DNS Servers: 192.168.30.20
4. Join the fabrikam.com domain
5. After rebooting, log into the server using FABRIKAM domain credentials (i.e. FABRIKAM\Administrator)
6. Disable Internet Explorer Enhanced Security Configuration (IE ESC)
   
   1. Open Server Manager > Local Server > IE Enhanced Security Configuration > Administrators > Off. Note: This should only be performed on lab servers for test purposes.
7. If you are installing SharePoint Foundation 2013 SP1 to a Virtual Machine I recommend you take a snapshot of the Virtual Machine at this point so that in the event that the SharePoint  install fails, you can revert to snapshot and try again vs. having to reinstall the Virtual Machine's Operating System.
8. Insert the Windows Server 2012 R2 installation media then run the following command from an elevated PowerShell window: Add-WindowsFeature Net-Framework-Core -Source <driveletter>:\sources\sxs. This will add  .NET Framework 3.5 to the server.
9. At this point I recommend you temporarily configure the server with an IP address that can reach the Internet since the prerequisite installer will attempt to connect to the Internet for most of the prerequisites. After obtaining the prerequisites or providing a means for the server to reach the Internet proceed to the next step.
10. Insert the SharePoint Foundation 2013 SP1 installation media then right click > Run as administrator  on the prerequisiteinstaller executable to start the installation.
11. Click Next > I Accept > Next > to begin the prerequisites installation.
12. Click Finish to reboot the server when prompted.
13. The prerequisites installer will install more prerequisites then click Finish to reboot when prompted.
14. Click Finish once the prerequisites have successfully installed, the server will reboot again.
15. Click Finish to complete the prerequisites installation.
16. At this point change the IP address back to the lab subnet if needed. For this blog I changed the IP address back to 192.168.30.22/24 with a DNS server IP address of 192.168.30.20.
17. Double click Setup from the SharePoint Foundation 2013 SP1 media to begin the installation SharePoint.
18. Click I Accept > Continue > Select Complete > Install Now
19. Click Close to run the SharePoint configuration wizard
    
20. Click Next > Yes > Create a new server farm > Next.
21. For the Database server type FABR-SQ01
22. For the Username type FABRIKAM\srv_SP, enter the Password then click Next
23. Enter a passphrase when prompted then click Next.
24. Select Negotiate (Kerberos) then click Next
25. Click Yes to use Kerberos > Next > after the installation is complete click Finish.
26. Select whether you wish to participate in the Customer Experience Improvement Program then click OK.
27. You should now be able to view FABRIKAM's Central Admin page as shown in the following Figure.

Configure FABRIKAM's SharePoint Foundation 2013 SP1 Server

The following steps will complete the configuration of FABRIKAM's SharePoint server and will create the SharePoint Application that will later be used by federated users.

1. From the Central Administration page shown in the preceding Figure, click Start the Wizard
2. Select Use an existing managed account, leave everything else at their defaults then click Next. Note: A new account should be used here for a production environment
3. Once the farm is created enter the following information to create a site Collection
   
   1. Title: FABRIKAM SharePoint
   2. Description: FABRIKAM's Portal
   3. Template: Team Site
   4. Click OK
4. Click Finish
5. Click Application Management > Configure Alternate Access Mappings
   
6. Highlight https://fabr-sp01 as shown in the following figure then click Edit Public URLs
7. 
8. Under Alternate Access Mapping Collection change "No Selection" to SharePoint - 80
9. Type https://www.fabrikam.com for the Default URL then click Save.
10. Click Application Management > Manage Web Applications > Highlight SharePoint -80 > Authentication Providers
11. Click Default then click Enable Anonymous Access
12. Ensure Integrated Windows authentication is set to Negotiate (Kerberos) then click Save
    
13. Close the dialogue box then click Anonymous Policy. Select Deny Write - Has no write Access then click Save.
    
14. Open an Elevated PowerShell window and type the following command: Get-Certificate -Template WebServer -DnsName www.fabrikam.com -CertStoreLocation cert:\LocalMachine\My
15. You should now have a web server certificate with a subject name of www.fabrikam.com
    
16. Configure IIS Bindings for the new certificate
    1. Open IIS Manager > Expand Sites > Highlight SharePoint - 80 > Click Bindings
       
    2. Click Add > https
    3. Select the certificate you just obtained then click OK > Close
17. Open an elevated PowerShell command prompt and type the following command setspn -S HTTP/www.fabrikam.com srv_SP
18. Open a web browser and type the following URL: https://www.fabrikam.com. If you get a username/password prompt enter FABRIKAM\Administrator and the Password then click OK.
    
19. The portal should appear as shown in the following Figure.
20. 
21. Click the gear icon in the upper right corner > Site Settings > Site Permissions
22. Click Anonymous Access > Anonymous users can access > Entire Web Site > Click OK
23. Clear out all cookies and close and re-open the browser. You should now be able to view FABRIKAM's SharePoint portal anonymously. As shown in the following Figure.

Wrap-Up

You now have two forests one named contoso.com and one named fabrikam.com along with the DNS records, certificate services, database services, CONTOSO's SharePoint Foundation 2013 SP1 services, and FABRIKAM's SharePoint Foundation 2013 SP1  needed to support AD FS. In the upcoming parts the CONTOSO's and FABRIKAM's federation services and Web Application Proxies will be deployed and configured to support federated web SSO.

Troubleshooting

• If you cannot connect to the SQL server and the Windows Firewall is enabled ensure port TCP 1433 is enabled inbound on the Windows Firewall as per the following instructions.
• If SharePoint fails to install with an error stating that it cannot configure the Application IIS server ensure you are installing a version of SharePoint 2013 with SP1 integrated into it.
• If the installation of SharePoint fails half way through the install, verify that the service account has at least DB Owner on the SQL server for the target database
• If you get an error when attempting to obtain a certificate ensure that Domain Computers have rights to read the Web Server template
• If you get an error when attempting to obtain a certificate ensure that the CRL has not expired
• If you get repeated password prompts when viewing the portal even after it is set to anonymous, ensure the Web Application is set to Negotiate (Kerberos)
• If the page displays page not found ensure you created an A record for the site in DNS

Here is Part 1 - Overview

Here is Part 2 - Installing AD DS, AD CS, and DNS Records

Here is Part 3 - Installing SQL Database Services

Topology

The following topology highlights in yellow the two servers that will be built for parts 4a and 4b and where they fit into the overall topology. If you wish to see the full topology click here.

Background

Windows Server AD FS 2012 R2 provides trusts between organizations however the end users need a service to connect to in order to utilize that trust. SharePoint 2013 which will be deployed in this post will ultimately be the endpoint that users in the CONTOSO and FABRIKAM forests access and present federated identities to. I recommend studying the hardware and software requirements for SharePoint 2013 prior to deployment. For simplicity purposes, SharePoint Foundation 2013 SP1 will be used as a part of this blog series.

SharePoint 2013: Hardware and Software Requirements for SharePoint 2013

SharePoint Foundation 2013 with SP1: Additional Information / Download

OPTIONAL: Create ISO of SharePoint Foundation 2013 SP1 Installation

All of the servers and clients in this blog post are virtual and the first thing I ran into was that the SharePoint Foundation 2013 SP1 server installation files were contained in an executable. So I converted them to an ISO which is easier to mount and present to virtual machines using the following steps.

1. Download the SharePoint.exe executable file
2. Open a PowerShell Window and navigate to the download location
3. Type the following command from the PowerShell window: .\<name of file>.exe /extract
4. Select a location to extract the files to then click OK.
5. Obtain a copy of oscdimg.exe. Click here to read more about it.
6. Type the following command from a PowerShell window: .\oscdimg -n -d -m "sourcedirectory" "targetfile"
7. You should now have an ISO of the SharePoint Foundation 2013 installation media

Deploy CONTOSO's SharePoint Foundation 2013 SP1 Server

The following steps will deploy SharePoint Foundation 2013 SP1 server. If you are deploying a different version of SharePoint consult the documentation of the version you are installing. IMPORTANT: You must use SharePoint Foundation 2013 with SP1 to successfully install SharePoint Foundation 2013 on Windows Server 2012 R2. You can read more about the hardware and software requirements here.

1. Log into the CONTOSO domain controller (CONT-DC01) and create a new Domain User called srv_SP.
2. Log into the CONTOSO SQL server (CONT-SQ01) and give srv_SP sysadmin rights.
   
   1. Open SQL Server Management studio > Security > Logins > New Login > Search > Locations > Entire Directory > OK
   2. Type srv_SP > OK
   3. Select Server Roles > Check sysadmin > OK
   4. In a production environment the rights should be modified to give the service account the least permissions necessary after SharePoint is deployed.
      
3. Deploy a Windows Server 2012 R2 workgroup server and configure the IP addess, subnet mask, hostname, and DNS servers. For the purposes of this series the information will be as follows:
   1. Hostname: CONT-SP01
   2. IP Address: 192.168.30.4
   3. Subnet Mask: 255.255.255.0
   4. DNS Servers: 192.168.30.2
4. Join the contoso.com domain
5. After rebooting, log into the server using CONTOSO domain credentials (i.e. CONTOSO\Administrator)
6. Disable Internet Explorer Enhanced Security Configuration (IE ESC)
   
   1. Open Server Manager > Local Server > IE Enhanced Security Configuration > Administrators > Off. Note: This should only be performed on lab servers for test purposes.
7. If you are installing SharePoint Foundation 2013 SP1 to a Virtual Machine I recommend you take a snapshot of the Virtual Machine at this point so that in the event that the SharePoint  install fails, you can revert to snapshot and try again vs. having to reinstall the Virtual Machine's Operating System.
8. Insert the Windows Server 2012 R2 installation media then run the following command from an elevated PowerShell window: Add-WindowsFeature Net-Framework-Core -Source <driveletter>:\sources\sxs. This will add  .NET Framework 3.5 to the server.
9. At this point I recommend you temporarily configure the server with an IP address that can reach the Internet since the prerequisite installer will attempt to connect to the Internet for most of the prerequisites. After obtaining the prerequisites or providing a means for the server to reach the Internet proceed to the next step.
10. Insert the SharePoint Foundation 2013 SP1 installation media then right click > Run as administrator  on the prerequisiteinstaller executable to start the installation.
11. Click Next > I Accept > Next > to begin the prerequisites installation.
12. Click Finish to reboot the server when prompted.
13. The prerequisites installer will install more prerequisites then click Finish to reboot when prompted.
14. Click Finish once the prerequisites have successfully installed, the server will reboot again.
15. Click Finish to complete the prerequisites installation.
16. At this point change the IP address back to the lab subnet if needed. For this blog I changed the IP address back to 192.168.30.4/24 with a DNS server IP address of 192.168.30.2.
17. Double click Setup from the SharePoint Foundation 2013 SP1 media to begin the installation SharePoint.
18. Click I Accept > Continue > Select Complete > Install Now
19. Click Close to run the SharePoint configuration wizard
    
20. Click Next > Yes > Create a new server farm > Next.
21. For the Database server type CONT-SQ01
22. For the Username type CONTOSO\srv_SP, enter the Password then click Next
23. Enter a passphrase when prompted then click Next.
24. Select Negotiate (Kerberos) then click Next
25. Click Yes to use Kerberos > Next > after the installation is complete click Finish.
26. Select whether you wish to participate in the Customer Experience Improvement Program then click OK.
27. You should now be able to view CONTOSO's Central Admin page as shown in the following Figure.

Configure CONTOSO's SharePoint Foundation 2013 SP1 Server

The following steps will complete the configuration of CONTOSO's SharePoint server and will create the SharePoint Application that will later be used by federated users.

1. From the Central Administration page shown in the preceding Figure, click Start the Wizard
2. Select Use an existing managed account, leave everything else at their defaults then click Next. Note: A new account should be used here for a production environment
3. Once the farm is created enter the following information to create a site Collection
   
   1. Title: CONTOSO SharePoint
   2. Description: CONTOSO's Portal
   3. Template: Team Site
   4. Click OK
4. Click Finish
5. Click Application Management > Configure Alternate Access Mappings
   
6. Highlight https://cont-sp01 as shown in the following figure then click Edit Public URLs
7. 
8. Under Alternate Access Mapping Collection change "No Selection" to SharePoint - 80
9. Type https://www.contoso.com for the Default URL then click Save.
10. Click Application Management > Manage Web Applications > Highlight SharePoint -80 > Authentication Providers
11. Click Default then click Enable Anonymous Access
12. Ensure Integrated Windows authentication is set to Negotiate (Kerberos) then click Save
    
13. Close the dialogue box then click Anonymous Policy. Select Deny Write - Has no write Access then click Save.
    
14. Open an Elevated PowerShell window and type the following command: Get-Certificate -Template WebServer -DnsName www.contoso.com -CertStoreLocation cert:\LocalMachine\My
15. You should now have a web server certificate with a subject name of www.contoso.com
    
16. Configure IIS Bindings for the new certificate
    1. Open IIS Manager > Expand Sites > Highlight SharePoint - 80 > Click Bindings
       
    2. Click Add > https
    3. Select the certificate you just obtained then click OK > Close
17. Open an elevated PowerShell command prompt and type the following command setspn -S HTTP/www.contoso.com srv_SP
18. Open a web browser and type the following URL: https://www.contoso.com. If you get a username/password prompt enter CONTSO\Administrator and the Password then click OK.
    
19. The portal should appear as shown in the following Figure.
20. 
21. Click the gear icon in the upper right corner > Site Settings > Site Permissions
22. Click Anonymous Access > Anonymous users can access > Entire Web Site > Click OK
23. Clear out all cookies and close and re-open the browser. You should now be able to view CONTOSO's SharePoint portal anonymously. As shown in the following Figure.

Wrap-Up

You now have two forests one named contoso.com and one named fabrikam.com along with the DNS records, certificate services, database services, and CONTOSO's SharePoint Foundation 2013 services  needed to support AD FS. In part 4b SharePoint Foundation 2013 SP1 will be deployed in FABRIKAM's forest.

Click here to proceed with the steps to deploy FABRIKAM's SharePoint Foundation 2013 SP1 services.

Troubleshooting

• If you cannot connect to the SQL server and the Windows Firewall is enabled ensure port TCP 1433 is enabled inbound on the Windows Firewall as per the following instructions.
• If SharePoint fails to install with an error stating that it cannot configure the Application IIS server ensure you are installing a version of SharePoint 2013 with SP1 integrated into it.
• If the installation of SharePoint fails half way through the install, verify that the service account has at least DB Owner on the SQL server for the target database
• If you get an error when attempting to obtain a certificate ensure that Domain Computers have rights to read the Web Server template
• If you get an error when attempting to obtain a certificate ensure that the CRL has not expired
• If you get repeated password prompts when viewing the portal even after it is set to anonymous, ensure the Web Application is set to Negotiate (Kerberos)
• If the page displays page not found ensure you created an A record for the site in DNS