{"id":13024,"date":"2015-06-11T10:30:00","date_gmt":"2015-06-11T08:30:00","guid":{"rendered":"http:\/\/nolabnoparty.com\/?p=13024"},"modified":"2016-08-01T08:42:24","modified_gmt":"2016-08-01T06:42:24","slug":"adfs-3-0-install-wap-server-pt-4","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/adfs-3-0-install-wap-server-pt-4\/","title":{"rendered":"ADFS 3.0 install WAP Server - pt. 4"},"content":{"rendered":"

\"adfs30installwap01\"<\/p>\n

To perform SSO with Office 365 outside the LAN, we need to configure the ADFS 3.0 service adding a WAP server placed in the DMZ zone.<\/p>\n

The Windows 2012 R2 with WAP role must be configured as standalone server<\/strong> and NOT joined to the domain.<\/p>\n

<\/p>\n

 <\/p>\n

Blog series<\/h2>\n

ADFS 3.0 setup UPN suffix for Office 365 SSO - pt. 1<\/a>
\nADFS 3.0 SSL certificate signing request - pt. 2<\/a>
\nADFS 3.0 install ADFS Server - pt. 3<\/a>
\nADFS 3.0 install WAP Server - pt. 4
\nADFS 3.0 federating Office 365 - pt. 5<\/a>
\nADFS 3.0 install Directory Sync tool - pt. 6<\/a>
\nADFS 3.0 deploy Office 365 - pt. 7<\/a><\/p>\n

 <\/p>\n

Configure hosts file<\/h2>\n

Since the WAP server in the DMZ<\/strong> needs to communicate with the internal ADFS server to perform the authentication against Active Directory<\/strong>, a DNS entry must be configured in the hosts file of the server.<\/p>\n

Open the hosts file<\/strong> located in C:\\Windows\\System32\\drivers\\etc<\/strong> and add a new entry specifying the IP\u00a0 address of the ADFS server and the given name of the service.<\/p>\n

\"adfs30installwap02\"<\/p>\n

Ping from WAP server to ADFS server in order to verify the correct DNS resolution<\/strong>.<\/p>\n

\"adfs30installwap03\"<\/p>\n

 <\/p>\n

Install WAP role<\/h2>\n

From the Server Manager<\/strong> click Add roles and features<\/strong>\u00a0to add the WAP role in the server.<\/p>\n

\"adfs30installwap04\"<\/p>\n

Click Next<\/strong> to start the role configuration.<\/p>\n

\"adfs30installwap05\"<\/p>\n

Select Role-based or feature-based installation<\/strong> option then click Next<\/strong>.<\/p>\n

\"adfs30installwap06\"<\/p>\n

Select the option Select a server from the server pool<\/strong>, highlight the server from the list and click Next<\/strong>.<\/p>\n

\"adfs30installwap07\"<\/p>\n

Select Remote Access<\/strong> role and click Next<\/strong>.<\/p>\n

\"adfs30installwap08\"<\/p>\n

No additional features to add, click Next<\/strong>.<\/p>\n

\"adfs30installwap09\"<\/p>\n

Click Next<\/strong> to continue.<\/p>\n

\"adfs30installwap10\"<\/p>\n

Select the\u00a0Web Application Proxy<\/strong>\u00a0role service.<\/p>\n

\"adfs30installwap11\"<\/p>\n

Since the role requires additional tools to be installed, click on Add Features<\/strong> to proceed.<\/p>\n

\"adfs30installwap12\"<\/p>\n

Once the additional features has been added and the Web Application Proxy<\/strong> role service is selected, click Next<\/strong>.<\/p>\n

\"adfs30installwap13\"<\/p>\n

Thick Restart the destination server automatically if required<\/strong> option then click Yes<\/strong> to confirm.<\/p>\n

\"adfs30installwap14\"<\/p>\n

Click Install<\/strong> to proceed with the role installation.<\/p>\n

\"adfs30installwap15\"<\/p>\n

The role is being installed in the server.<\/p>\n

\"adfs30installwap16\"<\/p>\n

Click Close<\/strong> to exit the Wizard.<\/p>\n

\"adfs30installwap17\"<\/p>\n

 <\/p>\n

Import the SSL certificate<\/h2>\n

Since an SSL certificate is required to establish the https connection to WAP server<\/strong>, same certificate installed in ADFS server can be used.<\/p>\n

Open the Certificates<\/strong> snap-in console, right click Personal<\/strong> item and select All Tasks > Import<\/strong> options.<\/p>\n

\"adfs30installwap18\"<\/p>\n

Click Next<\/strong> to continue.<\/p>\n

\"adfs30installwap19\"<\/p>\n

In the File name<\/strong> field select the SSL certificate previously exported (see part 2<\/a>) through the Browse<\/strong> button then click Next<\/strong>.<\/p>\n

\"adfs30installwap20\"<\/p>\n

Type the Password<\/strong> for the private key, select option Include all extended properties<\/strong> then click Next<\/strong>.<\/p>\n

\"adfs30installwap21\"<\/p>\n

Select Place all certificates in the following store<\/strong> option and use Personal<\/strong> as certificate store. Click Next<\/strong> to continue.<\/p>\n

\"adfs30installwap22\"<\/p>\n

To complete the certificate import click on Finish<\/strong> button.<\/p>\n

\"adfs30installwap23\"<\/p>\n

Click OK<\/strong> to close the confirmation window.<\/p>\n

\"adfs30installwap24\"<\/p>\n

Select Certificates<\/strong> > Personal<\/strong> to verify the imported certificate.<\/p>\n

\"adfs30installwap25\"<\/p>\n

 <\/p>\n

Configure WAP<\/h2>\n

After installing the WAP role, the service has to be configured. Click on Open the Web Application Proxy Wizard<\/strong> to begin the setup.<\/p>\n

\"adfs30installwap26\"<\/p>\n

Click Next<\/strong> when the WAP Configuration Wizard starts.<\/p>\n

\"adfs30installwap27\"<\/p>\n

Type the configured name in the Federation service name<\/strong> field (i.e. sts.nolabnoparty.com<\/em>) and enter the credential of a local administrator account<\/strong> of the server (remember the server is NOT joined to the domain). Click Next<\/strong> when done.<\/p>\n

\"adfs30installwap28\"<\/p>\n

Select the imported SSL certificate<\/strong> to be used by the ADFS proxy.<\/p>\n

\"adfs30installwap29\"<\/p>\n

Click Configure<\/strong> to start the WAP configuration.<\/p>\n

\"adfs30installwap30\"<\/p>\n

The service is being configured.<\/p>\n

\"adfs30installwap31\"<\/p>\n

When the process has been completed, click Close<\/strong> to exit the Wizard.<\/p>\n

\"adfs30installwap32\"<\/p>\n

When you click on Close<\/strong>, automatically the Remote Access Management Console<\/strong> opens.<\/p>\n

 <\/p>\n

Publish application<\/h2>\n

To enable WAP, the application must be published from the Remote Access Management Console<\/strong>. In the Tasks<\/strong> pane, click on Publish<\/strong>.<\/p>\n

\"adfs30installwap33\"<\/p>\n

The Publish New Application Wizard<\/strong> window opens. Click Next<\/strong> to begin.<\/p>\n

\"adfs30installwap34\"<\/p>\n

Select the Pass-through<\/strong> option then click Next<\/strong>.<\/p>\n

\"adfs30installwap35\"<\/p>\n

Give a Name<\/strong> to the web application to be published. Type the External URL<\/strong> field, select the External certificate<\/strong> and specify the Backend server URL<\/strong>. Click Next<\/strong> when done.<\/p>\n

\"adfs30installwap36\"<\/p>\n

To publish the web application click on Publish<\/strong> button.<\/p>\n

\"adfs30installwap37\"<\/p>\n

When the application has been published successfully, click Close<\/strong> to exit the Wizard.<\/p>\n

\"adfs30installwap38\"<\/p>\n

The web application shows up in the Published Web Applications<\/strong> list. Close the Remote Access Management Console<\/strong>.<\/p>\n

\"adfs30installwap39\"<\/p>\n

 <\/p>\n

Test the connection<\/h2>\n

To test the authentication process, from a device outside the LAN type the following URL in the browser:<\/p>\n

https:\/\/adfsname.domain.com\/adfs\/ls\/IdpInitiatedSignon.aspx<\/p><\/blockquote>\n

In the example, the address https:\/\/sts.nolabnoparty.com\/adfs\/ls\/IdpInitiatedSignon.aspx<\/strong> is used in the browser.<\/p>\n

Click the Sign in<\/strong> button.<\/p>\n

\"adfs30installwap40\"<\/p>\n

Enter the organizational account credentials and click Sign in<\/strong> button.<\/p>\n

\"adfs30installwap41\"<\/p>\n

If the system shows the You are signed in<\/strong> message, the service is working as expected.<\/p>\n

\"adfs30installwap42\"<\/p>\n

Part 5<\/a> will cover the federation process<\/strong> to connect the on-premises Active Directory with Office 365 platform.<\/p>\n

\"firma\"<\/p>\n","protected":false},"excerpt":{"rendered":"

To perform SSO with Office 365 outside the LAN, we need to configure the ADFS 3.0 service adding a WAP server placed in the DMZ zone. The Windows 2012 R2 with WAP role must be configured as standalone server and NOT joined to the domain.<\/p>\n","protected":false},"author":3,"featured_media":12982,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[1065,1721],"tags":[1564,1573,1583,1567],"class_list":["post-13024","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-en","category-office365-en","tag-adfs","tag-dmz","tag-office365","tag-wap","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/13024","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=13024"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/13024\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/12982"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=13024"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=13024"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=13024"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}