Using AD FS for SAML 2.0 Authentication

Scenarios

This section uses the SSO integration between Workspace and AD FS as an example to describe the end-to-end configuration process between the IdP and Workspace. This example is to set up an AD FS environment on an ECS.

Prerequisites

You have created a Windows Server 2016 or Windows Server 2019 ECS by referring to Purchasing an ECS. Then, configure the following services on the ECS:

• Active Directory Domain Services (AD DS): This provides functions such as creating, querying, and modifying objects such as domain users and domain devices. If an AD domain server is already available, skip this step.
• Active Directory Federation Service (AD FS): This allows for configuration of SSO relying party trusts and provides SSO authentication for all configured relying party trusts.

Step 1: Installing AD CS

1. Log in to the AD server using the account and password.
2. Press Win+R. In the displayed Run dialog box, enter servermanager and press Enter to go to the Server Manager page.
3. On the left of the Server Manager page, click Dashboard and click Add Roles and Features to go to the Add Roles and Features Wizard page.
4. Under Select Installation Type, select Role-Based or feature-based installation. Then, click Next.
5. Select Select a server from the server pool and click Next.
6. On the Select Server Roles page, select Active Directory Certificate Services to go to the Add Roles and Features Wizard page.
7. Click Add Features and click Next.
8. Click Next and then Next again.
9. In the Role Services area, select Certification Authority and Certification Authority Web Enrollment, and click Next.
10. On the Confirm installation selections page, click Install.
    

    Do not close the wizard during the installation.

11. Wait until the installation is complete. Then, click Configure Active Directory Certificate Services on the Destination Server to go to the AD CS Configuration page.
12. Click Next.
13. In the Role Services area, select Certification Authority and Certification Authority Web Enrollment, and click Next.
14. On the Setup Type page, select Enterprise CA and click Next.
15. On the Specify the type of the CA page, select Root CA and click Next.
16. On the Specify the type of the private key page, select Create a new private key and click Next.
17. On the Cryptography for CA page, keep the default setting RSA#Microsoft Software Key Storage Provider and the default key character length (2,048).

    Select the default hash algorithm SHA256. Then, click Next.

18. On the CA Name page, specify the CA name and click Next.
    • Common name for this CA: You are advised to use the default name, but you can change it if required.
    • Distinguished name suffix: This parameter is optional. It is left blank by default.
    • Preview of distinguished name: You are advised to use the default name, but you can change it if required.

19. On the Validity Period page, you can retain the default value (5 years) of Specify the validity period, or you can change the value if needed. Then, click Next.
20. In the Specify the database locations area on the CA Database page, specify the certificate database location and certificate database log location. If you specify a location other than the default, ensure that you use an access control list (ACL) to protect folders by preventing CA databases and logs from unauthorized access. Then, click Next.
21. On the Confirm page, click Configure to complete the installation.

    

22. On the cloud server, access http://localhost/certsrv using your browser. If the following figure is displayed, the CA has been successfully installed.

    

Step 2: Installing AD FS

1. In the ECS list, locate the created ECS, and click Remote Login in the Operation column.
2. Click Send CtrlAltDel in the upper right corner of the remote login screen.
3. Enter the password of the ECS to log in.
4. On the taskbar in the lower left corner, click .
5. On the right of the Start menu, click Server Manager. The Server Manager window is displayed, as shown in the following figure.

   

6. In the upper right corner of the Server Manager window, choose Tools > Internet Information Services (IIS) Manager, as shown in the following figure.

   

7. In the Internet Information Services (IIS) Manager, and double-click Server Certificates, as shown in the following figure.

   

8. On the right of the Server Certificates page, click Create Certificate Request, as shown in the following figure.

   

9. On the displayed page, enter the required information, as shown in the following figure.

   

10. Click Next, retain the default settings for the secret service provider properties, and click Next.
11. Specify a file name for the certificate request, for example, ADServer.txt, as shown in the following figure.

    

12. Click Finish.
13. On the cloud server, access http://localhost/certsrv using your browser.
14. On the displayed page, choose Request a certificate > Advanced certificate request > Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.
15. On the displayed Submit a Certificate Request or Renewal Request page, copy the saved content in 11 to the text box shown in the following figure, select Web Server from the Certificate Template drop-down list, and click Submit.

    

16. Wait until the certificate is issued. Then, download the certificate.
17. On the Server Certificates page, click Complete Certificate Request. On the displayed page, select the certificate downloaded in 16 and click OK, as shown in the following figure.

    

18. In the left pane of the Internet Information Services (IIS) Manager window, choose Sites > Default Web Site, and right-click Edit Bindings from the shortcut menu, as shown in the following figure.

    

19. On the Site Bindings page, click Add on the right.
    • Type: https
    • IP address: all unassigned
    • Port: 443
    • SSL certificate: Select the certificate in 17.

20. Open the Server Manager window, click Add roles and features on the dashboard page, retain the default settings, and keep clicking Next.
21. On the page for selecting server roles, select Active Directory Federation Services, retain the default settings, and click Next until the installation is complete.
22. On the installation completion page, click Configure the federation service on this server, as shown in the following figure.

    

23. Retain the default settings and click Next twice.
24. On the Specify service attributes page, click Import to import the certificate specified in 11, select the federation service name and display name, and click Next.
25. Set the account. Specifically, click Select to choose an existing domain user account or group hosting service account, and click Next.
26. Retain the default settings and click Next and then Configure.
27. Visit the address for metadata downloading in your browser to download the IDP metadata.

    Example: Determine the AD FS domain name, for example, saml.huawei.com

    The download address: https://saml.huawei.com/FederationMetadata/2007-06/FederationMetadata.xml

Step 3: Configuring AD FS as a Trusted SAML IdP in Workspace

1. Log in to the management console.
2. In the navigation pane, choose Tenant Configuration > Authentication Configuration. On the Primary Authentication page, click Modify.
3. Select Third-party SSO authentication as the primary authentication type.
4. Select SAML2.0 as the protocol type and configure the settings as described in Table 1.

   Table 1 SAML configuration items

   Configuration Item	Description	Reference Value	Provider
   Identity Provider Name	The name is user-defined and can contain 1 to 64 characters. Only letters, digits, and hyphens (-) are supported.	Azure	Defined by the tenant
   Access Server Address	Internet access address or Direct Connect access address. The value contains 1 to 255 characters and cannot be empty.	https://100.100.66.10:8443	Provided by the tenant. It can be obtained from the Workspace console.
   IDP Metadata	An IdP metadata file. It contains the IdP configuration details, including the IdP's entity ID, supported authentication methods, and signature certificates. The file must be a valid UTF-8-encoded XML file, and the file size cannot exceed 1 MB.	Download the IdP metadata from the AD FS server. For details, see the metadata XML file downloaded in 27. Click Add File to upload the federated metadata XML file downloaded from the third-party authentication platform.	Provided by the SAML IdP
   User ID	The user ID in URL format. The user ID must be the same as the Workspace username.	http://schemax.xxx.xxx	Provided by the SAML IdP

5. Click Save, and click Download on the right of SP Metadata to download the SP metadata.

Step 4: Configuring Workspace as a Trusted SAML SP on the AD FS Server

1. Log in to the AD FS server using the account and open the Server Manager window.
2. In the window, choose Tools > AD FS Management, as shown in the following figure.

   

3. In the navigation pane of the AD FS management tool, right-click Relying Party Trusts and choose Add Relying Party Trust.
4. In the displayed Add Relying Party Trust Wizard window, click Start.
5. On the Select Data Source page, select Import data about the relying party from a file and upload the SP metadata file downloaded in 5, as shown in the following figure.

   

6. Click Next and specify the display name as required.
7. Keep clicking Next until the configuration is complete. Mutual trust is established between Workspace and AD FS. You can check the trusted sites.

Step 5: Configuring SAML Assertion Attributes for the SP

1. Log in to the AD FS server using the account and open the Server Manager window.
2. In the window, choose Tools > AD FS Management, as shown in the following figure.

   

3. On the AD FS tool page, choose Relying Party Trusts > Edit Claim Issuance Policy, as shown in the following figure.

   

4. In the displayed window, click Add Rule to add the following two rules:
   • Transform an Incoming Claim

     

     

   • Send LDAP Attributes as Claims

     

     

5. Click Finish.

Step 6: Verifying the Login

1. Open the Huawei Cloud client, enter the server address and enterprise ID, and click Connect to the server.

   

2. Click Log In. You are directed to the Microsoft Entra ID authentication platform.

   

3. Enter the username and password. You are directed to the desktop list.
4. Click the desktop you want to log in to.