Planning AD FS Certificates

Several certificates are used with the federation service. The first of these is referred to as the server authentication certificate, which is a standard SSL certificate used to secure communications between federation servers, clients, and federation server proxy computers. The server authentication certificate must be purchased from a public certificate authority using the federation service FQDN as the subject name. The certificate is then applied to each of the federation servers in the AD FS topology.

Tip

If a Lync hybrid deployment is planned, the subject name of the server authentication certificate instead needs to be sts.<SIPdomain>, where <SIPdomain> is the DNS domain that will be split across the Lync Online and Lync on-premise deployments. For details, see the “Planning for a Hybrid Deployment” section of this chapter.

The second type of certificate required is the token-signing certificate, which is a standard x.509 certificate used to digitally sign all security tokens that are created. This certificate is not public-facing; however, the public key associated with the cert must be supplied to Lync Online/Office 365 as part of a trust configuration. By default, AD FS automatically generates a self-signed certificate for token-signing every year and automatically rolls it over before the certificate expires.

Tip

When the token-signing certificate is rolled over, the online tenant needs to be notified about this change; otherwise, requests to the online tenant will fail. To avoid this situation, Microsoft provides a utility named Microsoft Office 365 Federation Metadata Update Automation Administration Tool, which can be downloaded free. When installed, the tool automatically monitors and updates the Office 365 federation metadata on a regular basis, so that any changes made to the token-signing certificate are replicated to the online tenant automatically, preventing an outage.

The federation server proxy systems also require a standard SSL certificate to secure communications with client systems on the Internet, as well as the internal federation servers. However, as shown in Figure 28.4, the same public FQDN is assigned to both the federation service and the federation proxy cluster. For this reason, the same SSL certificate assigned as the server authentication certificate on the federation servers can also be used on the federation server proxy systems.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset