Академический Документы
Профессиональный Документы
Культура Документы
Abstract
This step-by-step guide provides instructions for setting up a test environment to deploy and
evaluate Active Directory Rights Management Services (AD RMS) with federated identity support
in Windows Server® 2008. It includes the necessary information for installing and configuring
AD RMS and AD FS and verifying AD RMS features after configuration is complete.
This document is provided for informational purposes only and Microsoft makes no warranties,
either express or implied, in this document. Information in this document, including URL and other
Internet Web site references, is subject to change without notice. The entire risk of the use or the
results from the use of this document remains with the user. Unless otherwise noted, the example
companies, organizations, products, domain names, e-mail addresses, logos, people, places, and
events depicted herein are fictitious, and no association with any real company, organization,
product, domain name, e-mail address, logo, person, place, or event is intended or should be
inferred. Complying with all applicable copyright laws is the responsibility of the user. Without
limiting the rights under copyright, no part of this document may be reproduced, stored in or
introduced into a retrieval system, or transmitted in any form or by any means (electronic,
mechanical, photocopying, recording, or otherwise), or for any purpose, without the express
written permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual
property rights covering subject matter in this document. Except as expressly provided in any
written license agreement from Microsoft, the furnishing of this document does not give you any
license to these patents, trademarks, copyrights, or other intellectual property.
Microsoft, Active Directory, MS-DOS, Windows, Windows NT, and Windows Server are either
registered trademarks or trademarks of Microsoft Corporation in the United States and/or other
countries.
5
• Guidance for setting up AD FS with Microsoft Office SharePoint Server 2007 and
AD RMS. For more information about using identity federation with Office SharePoint
Server 2007 and AD RMS, see Appendix A of the Deploying Active Directory Rights
Management Services with Microsoft Office SharePoint Server 2007 Step-By-Step Guide
(http://go.microsoft.com/fwlink/?LinkId=93136).
Note
Domain controllers
running Windows 2000
Server with Service
Pack 4 can be used.
However, in this step-by-
step guide it is assumed
that you will be using
domain controllers running
6
Computer Name Operating System Applications and Services
ADRMS-DB Windows Server 2003 with SP2 Microsoft SQL Server® 2005
Standard Edition with Service
Pack 2 (SP2)
Note
Before installing and configuring the components in this guide, you should verify that your
hardware meets the minimum requirements for AD RMS
(http://go.microsoft.com/fwlink/?LinkId=84733).
The computers form two private intranets and are connected through a common hub or Layer 2
switch. This configuration can be emulated in a virtual server environment, if desired. This step-
by-step exercise uses private addresses throughout the test lab configuration. The private
network ID 10.0.0.0/24 is used for the intranet. The domain controller for the domain named
cpandl.com is CPANDL-DC and the domain controller for the domain name treyresearch.net is
TREY-DC. The following figure shows the configuration of the test environment:
7
Step 1: Setting up the CP&L Enterprises
Domain
Before you install AD FS and the AD RMS Identity Federation Support role service, you need to
make changes to the infrastructure of the CPANDL domain. In this step, you will perform the
following tasks to install the required Active Directory Federation Services resource partner and
add it to the CP&L Enterprises infrastructure.
This section includes the following procedures:
• Install AD FS resource partner (ADFS-RESOURCE)
• Create the ADFSADMIN user account
8
• Add the ADFSADMIN user account to the local Administrators group on ADFS-
RESOURCE
• Configure a DNS forwarder
This step assumes that you have completed the Windows Server Active Directory Rights
Management Services Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=72134).
Use the following table as a reference when setting up the appropriate computer names,
operating systems, and network settings that are required to complete the steps in this guide.
Important
Before you configure your computers with static Internet Protocol (IP) addresses, we
recommend that you first complete Windows product activation while each of your
computers still has Internet connectivity. You should also install any available critical
security updates from Windows Update (http://go.microsoft.com/fwlink/?LinkID=47290).
Important
Windows Server 2003 R2 Enterprise Edition is required for the federation servers.
9
product CD.
2. Follow the instructions that appear on your computer screen, and when prompted
for a computer name, type ADFS-RESOURCE.
In this step configure TCP/IP properties so that ADFS-RESOURCE has a static IP address of
10.0.0.7.
Next, join the federation resource partner (ADFS-RESOURCE) computer to the CP&L domain:
Important
Windows Server 2008 Enterprise is required for the federation servers.
In this step, configure TCP/IP properties so that the ADFS-RESOURCE computer has a static IP
address of 10.0.0.7.
11
To join ADFS-RESOURCE to the cpandl.com domain
1. Click Start, right-click Computer, and then click Properties.
2. Click Change settings (at the right side under Computer name, domain, and
workgroup settings), and then click Change.
3. In the Computer Name/Domain Changes dialog box, select the Domain option,
and then type cpandl.com.
4. Click More, and type cpandl.com in Primary DNS suffix of this computer box.
5. Click OK, and then click OK again.
6. When a Computer Name/Domain Changes dialog box appears prompting you
for administrative credentials, provide the credentials of CPANDL\Administrator, and
then click OK.
7. When a Computer Name/Domain Changes dialog box appears welcoming you
to the cpandl.com domain, click OK.
8. When a Computer Name/Domain Changes dialog box appears telling you that
the computer must be restarted, click OK, and then click Close.
9. Click Restart Now.
12
To add ADFSADMIN to the Administrators group on a Windows Server 2003–based
server
1. Log on to ADFS-RESOURCE as cpandl\administrator.
2. Click Start, point to Administrative Tools, and then click Computer
Management.
3. Expand System Tools, expand Local Users and Groups, and then click
Groups.
4. Right-click Administrators, and then click Add to Group.
5. Click Add.
6. In the Select Users, Computers, or Groups window, type cpandl\adfsadmin,
and then click OK.
7. Click OK to close the Administrators properties sheet.
If you are running Windows Server 2008 Enterprise on ADFS-RESOURCE, use the following
procedure:
To configure the DNS forwarder when the computer is running Windows Server 2008:
Important
Before you configure your computers with static Internet Protocol (IP) addresses, we
recommend that you first complete Windows product activation while each of your
computers still has Internet connectivity.
14
Computer name Operating system requirement IP settings DNS settings
In this step configure TCP/IP properties so that TREY-DC has a static IP address of 10.0.0.30.
15
4. Click the Use the following IP address option. In the IP address box, type
10.0.0.30. In the Subnet mask box, type 255.255.255.0.
5. Click OK, and then click Close to close the Local Area Connection Properties
dialog box.
Note
If you need to use fewer computers to test this scenario, you can use the Dcpromo tool to
create two new Active Directory forests on both of the federation servers rather than
configuring separate domain controllers. As a security best practice, domain controllers
should not run as both federation servers and domain controllers in a production
environment.
16
To raise the domain functional level to Windows Server 2003
1. Log on to TREY-DC with the TREYRESEARCH\Administrator account or another
user account in the local Administrators group.
2. Click Start, point to Administrative Tools, and then click Active Directory
Users and Computers.
3. Right-click treyresearch.net, and then click Raise Domain Functional Level.
4. In the list under Select an available domain functional level, click Windows
Server 2003, and then click Raise.
Note
You cannot change the domain functional level once you have raised it.
5. Click OK, and then click OK again.
Next, configure TCP/IP properties so that TREY-DC has a IPv4 static IP address of 10.0.0.30.
Note
If you want to leave IPv6 enabled, you must assign a static IPv6 address before
configuring the computer as a domain controller.
7. Click OK, and then click Close to close the Local Area Connection Properties
dialog box.
Note
If you need to use fewer computers to test this scenario, you can use the Dcpromo tool to
create two new Active Directory forests on both of the federation servers rather than
configuring separate domain controllers. As a security best practice, domain controllers
should not run as both federation servers and domain controllers in a production
environment.
Note
You must restart the computer after you complete this procedure.
ADFSADMIN ADFSADMIN
19
user account in the local Administrators group.
2. Click Start, point to Administrative Tools, and then click Active Directory
Users and Computers.
3. In the console tree, expand treyresearch.net.
4. Right-click Users, point to New, and then click User.
5. In the New Object – User dialog box, type ADFSADMIN in the Full name and
User logon name boxes, and then click Next.
6. In the New Object – User dialog box, type a password of your choice in the
Password and Confirm password boxes. Clear the User must change password
at next logon check box, click Next, and then click Finish.
7. Perform steps 3-6 for Terrence Philip (tphilip).
Important
Windows Server 2003 R2 Enterprise Edition is required for the federation servers.
20
To install Windows Server 2003 R2 Enterprise Edition
1. Start your computer by using the Windows Server 2003 R2 Enterprise Edition
product CD.
2. Follow the instructions that appear on your computer screen, and when prompted
for a computer name, type ADFS-ACCOUNT.
In this step configure TCP/IP properties so that ADFS-ACCOUNT has a static IP address of
10.0.0.31.
Next, join the federation account partner (ADFS-ACCOUNT) computer to the TreyResearch
domain:
Finally, add the ADFSADMIN user account to the local Administrators group on ADFS-ACCOUNT.
Important
Windows Server 2008 Enterprise is required for the federation servers.
22
In this step configure TCP/IP properties so that the ADFS-ACCOUNT computer has a static IP
address of 10.0.0.31.
Finally, add the ADFSADMIN user account to the local Administrators group on ADFS-ACCOUNT.
23
To add ADFSADMIN to the Administrators group
1. Log on to ADFS-ACCOUNT with the TREYRESEARCH\Administrator account or
another user account in the local Administrators group.
2. To open Server Manager, click Start, point to Administrative Tools, and then
click Server Manager.
3. Expand Configuration, expand Local Users and Groups, and then click
Groups.
4. Double-click Administrators, click Add, type TREYRESEARCH\ADFSADMIN,
click OK, and then click OK again.
Next, configure TCP/IP properties so that ADRMS-CLNT2 has a static IP address of 10.0.0.32. In
addition, configure the DNS server of TREY-DC (10.0.0.30).
24
Next, join the ADRMS-CLNT2 to the TREYRESEARCH domain.
Next, we need to configure ADRMS-CLNT2 for federation support with AD RMS. This registry
entry assigns the AD FS home realm for AD RMS.
25
To install Microsoft Office Word 2007 Enterprise
1. Double-click setup.exe from the Microsoft Office 2007 Enterprise product CD.
2. Click Customize as the installation type, set the installation type to Not
Available for all applications except Microsoft Office Word 2007 Enterprise, and then
click Install Now. This might take several minutes to complete.
Important
Only the Ultimate, Professional Plus, and Enterprise editions of Microsoft Office 2007
allow you to create rights-protected content. All editions will allow you to consume rights-
protected content.
26
2. Click Start, point to Control Panel, and then click Add or Remove Programs.
3. In Add or Remove Programs, click Add/Remove Windows Components.
4. In the Windows Components Wizard, click Active Directory Services, and
then click Details.
5. In the Active Directory Services dialog box, click Active Directory Federation
Services (ADFS), and then click Details.
6. In the Active Directory Federation Services (ADFS) dialog box, select the
Federation Service check box, and then click OK. If Microsoft ASP.NET 2.0 was not
previously enabled, click Yes to enable it, and then click OK.
7. In the Active Directory Services dialog box, click OK.
8. In the Windows Components Wizard, click Next.
9. On the Federation Service page, click the Select token certificate option, and
select the certificate that should be used as the token signing certificate.
10. Under Trust policy, click Create a new trust policy, and then click Next.
11. If you are prompted for the location of the installation files, insert the Windows
Server 2003 R2 Enterprise Edition product disc, and then click OK.
12. On the Completing the Windows Components Wizard page, click Finish.
13. Log on to ADFS-ACCOUNT as TREYRESEARCH\ADFSADMIN.
14. Repeat steps 2–12 for the ADFS-ACCOUNT computer using the
TREYRESEARCH\ADFSADMIN user account.
To add the Federation Service role service on a Windows Server 2008 Enterprise–based
computer
1. Log on to ADFS-RESOURCE with the CPANDL\ADFSADMIN.
2. Click Start, point to Administrative Tools, and then click Server Manager.
3. If the User Account Control dialog box appears, confirm that the action it
displays is what you want, and then click Continue.
4. Click Add Roles.
5. On the Before You Begin page, click Next.
6. On the Select Server Roles page, click Active Directory Federation Services.
7. Click Next.
8. On the Introduction to AD FS page, click Next.
9. On the Select Role Services page, select the Federation Service check box. If
27
you are prompted to install additional role services, click Add Required Role
Services, and then click Next.
10. Select the Choose an existing certificate for SSL encryption option, click the
appropriate certificate, and then click Next.
11. On the Choose a Token-Signing Certificate page, select the Choose an
existing token-signing certificate option, click the appropriate certificate, and then
click Next.
12. Select the Create a new trust policy option, and then click Next.
13. Read the Introduction to Web Server (IIS) page, and then click Next.
14. Keep the Web server default check box selections, and then click Next
15. Click Install.
16. When the installation has completed, click Close.
17. Log on to ADFS-ACCOUNT as TREYRESEARCH\ADFSADMIN.
18. Repeat steps 2–16 for the ADFS-ACCOUNT computer using the
TREYRESEARCH\ADFSADMIN user account.
Note
The Federation Service URI value is case sensitive.
5. In the Federation Service endpoint URL box, confirm that https://ADFS-
ACCOUNT.treyresearch.net/adfs/ls/ is shown.
6. On the Display Name tab, in Display name for this trust policy, type Trey
Research, and then click OK.
28
To create a custom claim
1. In the Active Directory Federation Services console, expand Federation Service,
expand Trust Policy, and then expand My Organization.
2. Right-click Organization Claims, point to New, and then click Organization
Claim.
3. In the Claim name box, type ProxyAddresses.
Note
The claim name value is case-sensitive.
4. Select the Custom claim option, and then click OK.
Important
Great care should be taken when allowing proxy addresses through a federated trust. If
proxy addresses through federation are allowed, it is possible for a malicious user to
spoof an authorized user's credentials and access the user's rights-protected content. If
proxy addresses through federation is a requirement of your organization, you should
implement a claims transformation module that will examine a proxy address from a
federated user and make sure that it matches the forest in which the request originated.
The option to allow a proxy address from a federated user is turned off by default in the
Active Directory Rights Management Services console.
Next, add an Active Directory account store to the Federation Service for the TREYRESEARCH
domain.
Note
On Windows Server 2003 R2 Enterprise Edition this option is called Active
Directory.
5. On the Enable this Account Store page, select the Enable this account store
check box, and then click Next.
6. On the Completing the Add Account Store Wizard page, click Finish.
7. Double-click the E-mail organization claim, select the Enabled check box, type
mail in the LDAP attribute box, and then click OK.
8. Right-click the Active Directory account store, point to New, and then click
Custom claim extraction.
29
9. In the Attribute box, type ProxyAddresses, and then click OK.
Finally, add a resource partner to the Federation Service in the TREYRESEARCH domain.
Note
The Federation Service URL value is case sensitive.
7. In the Federation Service endpoint URL box, type https://adfs-
resource.cpandl.com/adfs/ls/, and then click Next.
8. On the Federation Scenario page, click the Federated Web SSO option, and
then click Next.
9. Select the UPN Claim and E-mail Claim check boxes, and then click Next.
10. Click the Pass all UPN suffixes through unchanged option, and then click
Next.
11. Click the Pass all E-mail suffixes through unchanged option, and then click
Next.
12. Ensure that the Enable this resource partner check box is checked, and then
click Next.
13. Click Finish.
14. Right-click the new CP&L Enterprises resource partner, point to New, and then
click Outgoing Custom Claim Mapping.
15. In the Outgoing custom claim name box, type ProxyAddresses, and then click
OK.
16. Close the Active Directory Federation Services console.
30
First, configure the ADFS-RESOURCE computer trust policy for the federation service in the
CPANDL domain.
Note
The Federation Service URI value is case sensitive.
5. In the Federation Service endpoint URL box, confirm that https://ADFS-
RESOURCE.cpandl.com/adfs/ls/ is shown.
6. On the Display Name tab, in Display name for this trust policy, type CP&L
Enterprises, and then click OK.
Note
The claim name value is case-sensitive.
4. Click the Custom claim option, and then click OK.
Next, add an Active Directory account store to the Federation Service for the CPANDL domain.
Note
On Windows Server 2003 R2 Enterprise Edition, this option is called Active
31
Directory.
5. On the Enable this Account Store page, select the Enable this account store
check box, and then click Next.
6. On the Completing the Add Account Store Wizard page, click Finish.
7. Double-click the E-mail organization claim, select the Enabled check box, type
mail in the LDAP attribute box, and then click OK.
8. Right-click the Active Directory account store, point to New, and then click
Custom claim extraction.
9. In the Attribute box, type ProxyAddresses, and then click OK.
Note
The application URL is case sensitive and the name of the AD RMS extranet
cluster should match the return URL value of the ADRMS-SRV computer exactly.
If the values do not match, AD FS functionality will not work.
7. On the Accepted Identity Claims page, select the User principal name (UPN)
and E-mail check boxes, and then click Next.
8. On the Enable this Application page, select the Enable this application check
box, and then click Next.
9. On the Completing the Add Application Wizard page, click Finish.
10. In the task pane, double-click ProxyAddresses, select the Enabled check box,
and then click OK.
Use the following procedure to add the AD RMS licensing pipeline as a claims-aware application.
32
3. On the Welcome to the Add Application Wizard page, click Next.
4. On the Application Type page, select the Claims-aware application option,
and then click Next.
5. In the Application display name box, type AD RMS Licensing.
6. In the Application URL box, type https://adrms-
srv.cpandl.com/_wmcs/licensingexternal/, and then click Next.
Note
The application URL is case sensitive and the computer name in the URL should
match the return URL value of the ADRMS-SRV computer exactly. If the values
do not match, AD FS functionality will not work.
7. On the Accepted Identity Claims page, select the User principal name (UPN)
and E-mail check boxes, and then click Next.
8. On the Enable this Application page, click the Enable this application check
box, and then click Next.
9. On the Completing the Add Application Wizard page, click Finish.
10. In the task pane, double-click ProxyAddresses, click the Enabled check box,
and then click OK.
Next, add an account partner to ADFS-RESOURCE. This account partner receives requests from
the ADFS-ACCOUNT computer in the TREYRESEARCH domain.
34
Add the AD RMS extranet cluster URLs
AD RMS-enabled clients consuming rights-protected content through a federated trust use the
AD RMS extranet cluster URLs to create a rights account certificate.
Caution
The AD RMS cluster URLs must be added before the Identity Federation Support role
service is added by using Server Manager. If the cluster URLs are not added, you must
edit the web.config files in the certificationexternal and licensingexternal directories
manually.
35
9. On the AD FS Role Service page, confirm that Claims-aware Agent is selected,
and then click Next.
10. Click Install to add the Identity Federation Support role service to the ADRMS-
SRV computer.
11. Click Finish.
36
ensure that your credentials are automatically passed from Microsoft Office Word to the AD RMS
Web services.
To add AD RMS cluster URL to the Internet Explorer Local Intranet security zone
1. Log on to ADRMS-CLNT2 as Terence Philip (TREYRESEARCH\tphilip).
2. Click Start, click Control Panel, click Network and Internet, and then click
Internet Options.
3. Click the Security tab, and then click Local Intranet.
4. Click Sites, and then click Advanced.
5. In the Add this website to the zone box, do the following:
a. Type https://adrms-srv.cpandl.com, and then click Add.
b. Type https://adfs-resource.cpandl.com, and then click Add.
c. Type https://adfs-account.treyresearch.net, and then click Add.
To verify the functionality of the AD RMS deployment, you log on as Nicole Holliday, create a
Microsoft Word 2007 document, and then restrict permissions on it so that Terrence Philip is able
to read the document but is unable to change, print, or copy it. You then log on as Terence Philip,
verifying that Terence Philip can read the document but do nothing else with it.
37
DB\PUBLIC \ADRMS-TST.docx. If you are prompted for credentials, use
CPANDL\Administrator.
The following message appears: "Permission to this document is currently restricted.
Microsoft Office must connect to https://adrms-srv.cpandl.com/_wmcs/licensing to
verify your credentials and download your permissions."
4. Click OK.
The following message appears: "Verifying your credentials for opening content with
restricted permissions".
5. When the document opens, click Microsoft Office Button. Notice that the Print
option is not available.
6. Click View Permission in the message bar. You should see that Terence Philip
has been restricted to being able only to read the document.
7. Click OK to close the My Permissions dialog box, and then close Microsoft
Word.
You have successfully deployed and demonstrated the functionality of using identity federation
with AD RMS, using the simple scenario of applying restricted permissions to a Microsoft
Word 2007 document. You can also use this deployment to explore some of the additional
capabilities of AD RMS through additional configuration and testing.
38