azure-samples / active-directory-lab-hybrid-adfs

Create a full AD/CA/ADFS/WAP lab environment with Azure AD Connect installed

Azure Active Directory Hybrid ADFS Lab

Creates full AD/CA/ADFS/WAP environment with Azure AD Connect installed

Quick Start

Description	Link
Full deploy - AD, ADFS, WAP
Full deploy - AD, ADFS, WAP, with client machines*

Details

• Deploys the following infrastructure:
• Virtual Network
• 3 subnets: AD, DMZ, Client
• 3 Network Security Groups:
  • AD - permits AD traffic, RDP incoming to network; limits DMZ access
  • Client - permissive; restricts traffic to DMZ
  • DMZ - restrictive; permits 443 traffic to Internal, RDP from internal, very limited traffic from Internal, no traffic to Internet or Internal
• Public IP Address for each node
• AD VM
  • DSC installs AD, CA roles, generates certificate for use by ADFS and WAP
  • Certificate is based on the public IP/DNS of the WAP deployment
  • Split-brain DNS on the DC is configured for the ADFS URL
  • The Azure vNet is updated with a custom DNS entry pointing to the DC
  • Test users are created in the local AD by passing in an array. There is an array sample set as the default value in the deployment template.
  • Azure Active Directory Connect is installed and available to configure.
• ADFS VM
  • DSC installs ADFS Role, pulls and installs cert from CA on the DC
  • CustomScriptExtension configures the ADFS farm
  • For unique testing scenarios, multiple distinct farms may be specified
  • Azure Active Directory Connect is installed and available to configure.
• WAP VM - one for each ADFS VM
  • DSC installs WAP role
  • CustomScriptExtension copies and installs the cert from the DC and connects to the ADFS farm

Notes

• A template is included for Client creation via MSDN images. You will need to update the URL to point to your images. Images must be named "OSImage_Win<version>". You are responsible for validating your licensing rights for client MSDN images in your subscription.
• The NSGs defined are for reference, but they aren't production-ready as holes are also opened for RDP to each VM directly, and public IPs are allocated for each VM as well
• One VM size is specified for all VMs
• Managed disks are used for all VMs - no storage accounts are created for diagnostics
• The root CA cert is usually updated automatically to domain-joined clients within hours. To accelerate this, an easy workaround is to reboot the client VM.
• In the AD DSC template, there is a commented draft of some code to push the ADFS FQDN out as an "Intranet Zone" site to the client machines - we've punted on that for now, so you will have to do this manually on client VMs in order to get ADFS SSO.

Caveats

• There has been an intermittent bug with regards to the script block that enables RDP access for non-admin (test) users within deployed client VMs (when the client deploy script is used). It doesn't affect the base lab functionality, but if you see an error regarding 'ConfigRDPUsers' during deployment, the AD admin may need to enable non-admin RDP access before a test user can login to one of the client VMs to try client SSO scenarios.

NOTICE/WARNING

• This template is explicitely designed for a lab environment. A few compromises were made, especially with regards to credential passing to DSC and script automation, that WILL result in clear text passwords being left behind in the DSC/scriptextension package folders, Azure log folders, and system event logs on the resulting VMs.

Bonus

The "deploy.ps1" file above can be downloaded and run locally against this repo, and offers a few additional features:

• After the deployment completes, it will create a folder on your desktop with the name of the resource group
• It will then create an RDP connectoid in that folder for each server and client that was deployed.
• It will then create an HTTP shortcut to the ADFS WAP endpoint for testing and confirming the deployment.

The deploy script master has a line that allows you to separate your specific variables from the master via dot-sourcing. Here's a sample dot-sourced variable overrides file:

#Login if necessary
$AzureSub = "My Azure Subscription"try { $ctx=Get-AzureRmContext -ErrorAction Stop }
catch { Login-AzureRmAccount }
if ($ctx.SubscriptionName -ne $AzureSub) { Set-AzureRmContext -SubscriptionName $AzureSub }

#DEPLOYMENT OPTIONS
    $Branch                  = "master"

    $VNetAddrSpace2ndOctet   = "2"
    $RGName                  = "TestRG$VNetAddrSpace2ndOctet"
    $DeployRegion            = "West US 2"
    $userName                = "localAdmin"
    $secpasswd               = "CrazyP@ssword"
    $adDomainName            = "aadpoctest.com"
    #$clientsToDeploy         = @("10-1511","10-1607","10-1703","7","8")
    $clientsToDeploy         = @("7")
    $clientImageBaseResource = "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/ImageRG/providers/Microsoft.Compute/images/"
    $AdfsFarmCount           = "1";
    $AssetLocation           = "https://raw.githubusercontent.com/Azure-Samples/active-directory-lab-hybrid-adfs/$Branch/lab-hybrid-adfs/"

    $usersArray              = @(
                                @{ "FName"= "Bob"; "LName"= "Jones"; "SAM"= "bjones" },
                                @{ "FName"= "Bill"; "LName"= "Smith"; "SAM"= "bsmith" },
                                @{ "FName"= "Mary"; "LName"= "Phillips"; "SAM"= "mphillips" },
                                @{ "FName"= "Sue"; "LName"= "Jackson"; "SAM"= "sjackson" }
                            );
    $defaultUserPassword     = "P@ssw0rd"
    $RDPWidth                = 1680
    $RDPHeight               = 1050

#END DEPLOYMENT OPTIONS

Contributing

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

active-directory-lab-hybrid-adfs's Issues

DSC Configuration 'DomainController' completed with error(s)

Hi,

I get this when i deploy the template with "no/with clients" option.

{ "status": "Failed", "error": { "code": "ResourceDeploymentFailure", "message": "The resource operation completed with terminal provisioning state 'Failed'.", "details": [ { "code": "VMExtensionProvisioningError", "message": "VM has reported a failure when processing extension 'Microsoft.Powershell.DSC'. Error message: \"DSC Configuration 'DomainController' completed with error(s). Following are the first few: No match was found for the specified search criteria for the provider 'NuGet'. The package provider requires 'PackageManagement' and 'Provider' tags. Please check if the specified package has the tags. No match was found for the specified search criteria for the provider 'NuGet'. The package provider requires 'PackageManagement' and 'Provider' tags. Please check if the specified package has the tags. No match was found for the specified search criteria and provider name 'NuGet'. Try 'Get-PackageProvider -ListAvailable' to see if the provider exists on the system.\"\r\n\r\nMore information on troubleshooting is available at https://aka.ms/VMExtensionDSCWindowsTroubleshoot " } ] } }

Can *clientImageBaseResource* be a marketplace image?

about clientImageBaseResource

how to do

Not working out of the box

First of all, thank you very much for your great work.

Now when this is out of the way :)

Tried deploying it in "North Europe" region

1. internal domain name should really be ".local", not "contoso.com".
2. public FQDN on test labs can be long (mine is "digital-online-somecompany.com"), this fails creating windows machines with "names are too long". (i added another parameter to template in my fork)
3. There's no internet connectivity from crated VMs to the outside internet, so any steps that download something from public internet will fail
4. Prolly due to #3 created VMs can't be joined to domain
5. Created VMs have Network "Ethernet" marked as "public"
6. DC role is not installed, prolly due to #3.

Validation error when deploying template

I received this validation error when attempting to deploy the first link template.
I think it has to do with multi-dotted FQDN (sub.domainname.com):
"companyNamePrefix": "[split(parameters('adDomainName'),'.')[0]]",

Deployment fails to load provisioning script for VM

Looks to be failing on the GitHub URL. That URL works fine manually, but the relative path in the script is not working.

{
  "code": "DeploymentFailed",
  "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details.",
  "details": [
    {
      "code": "Conflict",
      "message": "{\r\n  \"status\": \"Failed\",\r\n  \"error\": {\r\n    \"code\": \"ResourceDeploymentFailure\",\r\n    \"message\": \"The resource operation completed with terminal provisioning state 'Failed'.\",\r\n    \"details\": [\r\n      {\r\n        \"code\": \"VMExtensionProvisioningError\",\r\n        \"message\": \"VM has reported a failure when processing extension 'Microsoft.Powershell.DSC'. Error message: \\\"The DSC Extension failed to execute: Error downloading https://raw.githubusercontent.com/Azure-Samples/active-directory-lab-hybrid-adfs/master/lab-hybrid-adfs/DSC/adDSC.zip after 29 attempts: The remote name could not be resolved: 'raw.githubusercontent.com'.\\r\\nMore information about the failure can be found in the logs located under 'C:\\\\WindowsAzure\\\\Logs\\\\Plugins\\\\Microsoft.Powershell.DSC\\\\2.80.0.0' on the VM.\\\".\"\r\n      }\r\n    ]\r\n  }\r\n}"
    },
    {
      "code": "Conflict",
      "message": "{\r\n  \"status\": \"Failed\",\r\n  \"error\": {\r\n    \"code\": \"ResourceDeploymentFailure\",\r\n    \"message\": \"The resource operation completed with terminal provisioning state 'Failed'.\",\r\n    \"details\": [\r\n      {\r\n        \"code\": \"DeploymentFailed\",\r\n        \"message\": \"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details.\",\r\n        \"details\": [\r\n          {\r\n            \"code\": \"Conflict\",\r\n            \"message\": \"{\\r\\n  \\\"status\\\": \\\"Failed\\\",\\r\\n  \\\"error\\\": {\\r\\n    \\\"code\\\": \\\"ResourceDeploymentFailure\\\",\\r\\n    \\\"message\\\": \\\"The resource operation completed with terminal provisioning state 'Failed'.\\\",\\r\\n    \\\"details\\\": [\\r\\n      {\\r\\n        \\\"code\\\": \\\"VMExtensionProvisioningError\\\",\\r\\n        \\\"message\\\": \\\"VM has reported a failure when processing extension 'joindomain'. Error message: \\\\\\\"Exception(s) occured while joining Domain 'ADtest4'\\\\\\\".\\\"\\r\\n      }\\r\\n    ]\\r\\n  }\\r\\n}\"\r\n          }\r\n        ]\r\n      }\r\n    ]\r\n  }\r\n}"
    }
  ]
}

Deploy NoClientDeploy fails on "DeployAD" resource

I was able to run this NoClientDeploy setup before, but the recent deployment I've tried fails on resource with display name "DeployAD".

Any help is appreciated.

Compatibility with later versions of Windows Server

I need to set up an ADFS lab environment, but I'd like to use Windows Server 2016 or 2019 instead of 2012. Would this project work with a later version of Windows Server? What's likely to be incompatible?

Unable to deploy lab

Hi I'm getting the error below when attempting to deploy the lab, any help will be appreciated

{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details.","details":[{"code":"Conflict","message":"{\r\n "status": "Failed",\r\n "error": {\r\n "code": "ResourceDeploymentFailure",\r\n "message": "The resource operation completed with terminal provisioning state 'Failed'.",\r\n "details": [\r\n {\r\n "code": "DeploymentFailed",\r\n "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details.",\r\n "details": [\r\n {\r\n "code": "BadRequest",\r\n "message": "{\r\n \"error\": {\r\n \"code\": \"DnsRecordInUse\",\r\n \"message\": \"DNS record contosodc1.eastus.cloudapp.azure.com is already used by another public IP.\",\r\n \"details\": []\r\n }\r\n}"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n}"}]}