Export (0) Print
Expand All

Step 1: Preinstallation Tasks

Updated: November 15, 2007

Applies To: Windows Server 2008

Before you install Active Directory Federation Services (AD FS), you set up the four primary virtual machine (VM) computers that you will use to evaluate the AD FS technology.

Preinstallation tasks include the following:

Administrative credentials

To perform all of the tasks in this step, log on to each of the four computers with the local Administrator account. To create accounts in Active Directory Domain Services (AD DS), log on with the Administrator account for the domain.

Use the following table to set up the appropriate computer names, operating systems, and network settings that are required to complete the steps in this guide.

ImportantImportant
Before you configure your computers with static IP addresses, we recommend that you first:

  • Configure three new VMs with at least 512 megabytes (MB) of available memory.

  • Complete product activation for Windows XP or Windows Vista and Windows Server 2008 while each of your computers still has Internet connectivity.

  • Make sure that all of the clocks on each of the computers are set to the same time or within five minutes of each other. This is important to ensure that token times tamps are always valid.

 

Computer name AD FS client/server role Operating system requirement IPv4 settings DNS settings

adfsclient

Client

Windows XP with Service Pack 2 (SP2) or Windows Vista

IP address:

192.168.1.1

Subnet mask:

255.255.255.0

Preferred:

192.168.1.3

Alternate:

192.168.1.4

adfsweb

Web server

Windows Server 2008 Standard, or Windows Server 2008 Enterprise

IP address:

192.168.1.2

Subnet mask:

255.255.255.0

Preferred:

192.168.1.4

adfsaccount

Federation server and domain controller

Windows Server 2008 Enterprise

IP address:

192.168.1.3

Subnet mask:

255.255.255.0

Preferred:

192.168.1.3

adfsresource

Federation server and domain controller

Windows Server 2008 Enterprise

IP address

192.168.1.4

Subnet mask:

255.255.255.0

Preferred:

192.168.1.4

noteNote
Be sure to set both the preferred and alternate Domain Name System (DNS) server settings on the client. If both types of values are not configured as specified, the AD FS scenario will not function.

This section includes the following procedures:

You can use the Add Roles Wizard to create two new Active Directory forests on both of the federation servers. When you type values into the wizard pages, use the company names and Active Directory domain names in the following table. To start the Add Roles Wizard, click Start, click Administrative Tools, click Server Manager, and then, in the right pane, click Add Roles.

ImportantImportant
Configure the IP addresses as specified in the previous table before you attempt to install AD DS. This helps ensure that DNS records are configured appropriately.

noteNote
As a security best practice, do not run domain controllers as both federation servers and domain controllers in a production environment.

 

Computer name Company name Active Directory domain name (new forest) DNS configuration

adfsaccount

A. Datum Corporation

adatum.com

Install DNS when you are prompted.

adfsresource

Trey Research

treyresearch.net

Install DNS when you are prompted.

noteNote
In this guide, A. Datum represents the account partner organization and Trey Research represents the resource partner organization.

After you set up two forests, you start the Active Directory Users and Computers snap-in to create some accounts that you can use to test and verify federated access across both forests. Configure the values in the following table on the adfsaccount computer.

 

Object to create Name User name Action

Security global group

TreyClaimAppUsers

Not applicable

Not applicable

User

Alan Shen

alansh

(alansh acts as the federated user who will be accessing the claims-aware application.)

Make alansh a member of the TreyClaimAppUsers global group

Use the values in the following table to specify which computers are joined to which domain. Perform this operation on the adfsclient and adfsweb computers.

noteNote
You may have to disable the firewalls on both domain controllers before you can join the following computers to the appropriate domains.

 

Computer name Join to

adfsclient

adatum.com

adfsweb

treyresearch.net

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft