Microsoft – Resources to get more familiar with Active Directory Federation Services (ADFS)

Nowadays more and more work, communication and collaboration involves multiple external parties. This can involve by example employees, customers, partners, suppliers, cloud providers/platforms/applications.

This means it is becoming increasingly important to have proper authentication and authorization methods in place for single sign on (SSO) so users can be more productive. Besides the ease-of-use It can also lead to better security.

Microsoft’s Active Directory Federation Services (ADFS) will make this possible. For more information on ADFS, here are some resources. Keep in mind though that while some information may be outdated, it will give you a broad idea of the concept and the inner workings. The current version of ADFS in Windows Server 2012 is 2.1 , while Windows Server 2008 uses 2.0

• Active Directory Federation Services (TechNet)
• Active Directory Federation Services,Part 1: How Do They Really Work?
• Active Directory Federation Services,Part 2: Building Federated Identity Solutions
• Active Directory Federation Services 2.0 solution guide (including ForeFront UAG)
• Active Directory Federation Services 2.0 Deep Dive: Deploying a Highly Available Infrastructure
• AD FS 2.0 Step-by-Step and How To Guides
• AD FS with Office 365 Step by Step Install Guide
• ADFS 2.0 Setup Guide
• A Guide to Claims-Based Identity and Access Control (2nd Edition)
• Choosing Between Forefront TMG or Forefront UAG for Publishing Scenarios
• Cloud Security: The Practical Meaning of Security, Identity and Access Revealed!
• Complete walkthrough: Setting up a ADFS 2.0 Server on Windows Azure IaaS and Configuring it as an Identity Provider in Windows Azure ACS
• Demystified Series: Active Directory Federation Services (AD FS) Part 1
• Demystified Series: Active Directory Federation Services (AD FS) Part 2
• Deploying and Configuring ADFS 2.0
• Federated Identity in the Cloud [NZ 2010: SEC402]
• Federation and Federated Identity: Part 1 Active Directory Federation Services – How Do they Really Work?
• Federation and Federated Identity: Part 2 Building Federated Identity Solutions with Forefront Unified Access Gateway and ADFS v2
• Forefront UAG and ADFS: Better together
• Managing Identity in the Cloud with ADFS and Windows Azure – TechDays 2012
• MS Innovations Blog posts tagged with adfs
• Office 365 ADFS virtual lab
• Office 365 for SMB Jump Start (03) | Office 365 DirSync, Single Sign-On & ADFS
• Office 365 SSO: A Simplified Installation Guide
• Plan for and deploy AD FS for use with single sign-on
• Setting up Single Sign on with Office 365 using ADFS 2.0
• The Access Onion – Peeling away at Access Management, Identity Federation, PKI and SSO issues
• What’s new in Forefront UAG Service Pack 2 (also ADFS 2.0 changes)
• Windows Authentication, ADFS and the Access Control Service 
• Windows Server 2008 (R2) Active Directory Federation Services (TechNet)

PS: Microsoft is moving more and more towards claims based authentication. Examples include Windows Server 2012 Dynamic Access Control and also SharePoint 2013 that has switched to claims based authentication by default now.

If you have some other resources that might be useful, please let me know so I can add them as well.

 

Apple – Notes / summary for the “OS X Support Essentials 10.8 Exam”

As I already wrote in yesterday’s post Apple – Notes / summary for the “Mac Integration Basics 10.8 Exam”, I’ve mainly been working with Microsoft products all my life. Since recently however, I’m also trying to get more familiar with Apple, Mac products and OS X and am trying to become certified.

One of the reasons, I’d never used Apple products before was because I never really deemed it necessary. Nowadays the number of Mac users seem to be growing and there is more demand for people with Mac / OS X knowledge.

As such my quest for knowledge and certification began. For me personally this meant:

• Using Apple online resources
  • http://www.apple.com/support/
  • http://switchtoamac.com/
  • http://training.apple.com/itpro/macinteg/exam
• Reading books (mainly the great book Apple Pro Training Series: OS X Support Essentials. Before purchasing, you might also want to look for coupon codes as it might save you 30% off or more.)
• Watching computer based training (CBT) videos
• Working with OS X (thanks go out to my employer Open Line for providing me with a MacBook Pro, books and most importantly … TIME)
  • Personally I didn’t think it was necessary to take a course at a training center, but some people might prefer this.
• Asking colleagues for help (thanks guys !!!)
• Making sure that I understood everything and if it wasn’t the case, look it up.
• Taking notes / creating this summary blog post that can be used as a reference if needed
• Testing my knowledge using test questions from Revise IT

I’ve taken the exam last friday and passed with 92.5%. Even though I think it was a pretty good score, I still had to make some educated guesses. This made me realize that there’s still a lot to learn and that getting more experience is important as well.

I also want to mention that I took the exam at LAI the training institute for IT professionals in Schiedam (The Netherlands). They were really kind, helpful and service oriented. The waiting area and test room were great and they even provided a pastry and all kind of drinks at no charge. This has been my best test taking experience to date, so keep up the good work guys.

I’m looking forward to attending the OS X Server 10.8 course at LAI the training institute for IT professionals at the end of March. I’ll try to create another blog post about this as well.

But now back to the important stuff, here are my notes/summary. I hope it is useful. If you find any errors or have any suggestions, please leave a comment.

Notes / summary for the “OS X Support Essentials 10.8 Exam”

 

Security – Java releases update for major Java vulnerability

Last sunday I warned about a major vulnerability in Java.

It wasn’t expected that Java would come have an update available this quickly, but it is good that they did. So be sure to update to Java 7 Update 11 : http://java.com

 

Security – Major Java vulnerability, don’t become a victim

[EDIT 14-01-2013]

Oracle release Java 7 Update 11 to fix this security issue. Be sure to update: http://java.com/

[EDIT]

Normally when I read about security vulnerabilities, I don’t really get a sense of urgency.

With the current Java vulnerability however, I do feel like people have to act quick because there are so many respected companies and even countries actively taking action:

• Apple has disabled the Java 7 plugin on Macs through its OS X anti-malware system, in order to protect users from a potentially serious security issue
• Cisco: New Java Vulnerability Being Exploited in the Wild
• Mozilla Security Blog: Protecting Users Against Java Vulnerability in FireFox
• United States Computer Emergency Readiness Team (US-CERT) suggests disabling Java

Apparently this vulnerability is actively being exploited already and Oracle hasn’t released a Java fix yet. You might want to consider a combination of the options below:

• Updating Intrusion Prevention System (IPS) signatures (Cisco signature)
• Uninstall Java (Windows | Mac OS X)
• Disabling Java only for web browsers
• Disabling Java in specific web browsers

Personally I like the way FireFox is handling the issue because it blocks by default, but allows users to easily override this behavior for specific sites. Also I’m getting quite fed up with all these Java security vulnerabilities lately

I’d like to know what you’ll be doing. Have you or are you going to disable Java ? Which methods will you use ? Why ?

 

PowerShell – Determine which Active Directory objects are protected from accidental deletion

In yesterday’s post I showed some commands to protect all or specific Active Directory objects from accidental deletion.

In some situations (by example preparing for a change) you might want to know which objects are protected from accidental deletion and which are not. Also when multiple people make changes in an Active Directory it might prove difficult to keep track of the changes.

To determine the protection status of AD objects, I use a script that checks the ACL of the AD Object. When Everyone is explicitly Denied access, it is protected from accidental deletion.

 

PowerShell – Protect Active Directory objects from accidental deletion

In a previous blog post I explained how to enable the Active Directory Recycle Bin which allows you to restore deleted active directory object.

But even though it’s great to be able to restore objects, it is even better to prevent accidental deletion. What accidental deletion basically does, is modify the permissions on an AD object to Deny Everyone so you won’t be able to delete it by accident.

More information about protection from accidental deletion can be found in “Preventing Unwanted/Accidental deletions and Restore deleted objects in Active Directory” and ”Windows Server 2008 Protection from Accidental Deletion“.

In Windows Server 2012 with all the new cmdlets, it has become much easier to enable protection from accidental deletion.

By example, you could use these commands:

#Get-ADobject class names
get-adobject -filter * | select objectclass | group objectclass

#Protect specific AD object classes from accidental deletion
get-adobject -filter * | where{($_.ObjectClass -eq “container”) -or ($_.ObjectClass -eq “organizationalunit”) -or ($_.ObjectClass -eq “user”) -or ($_.ObjectClass -eq “group”) -or ($_.ObjectClass -eq “computer”)} | Set-ADObject -ProtectedFromAccidentalDeletion $true

#Protect all AD organizational units from accidental deletion
Get-ADOrganizationalUnit -filter * | Set-ADOrganizationalUnit -ProtectedFromAccidentalDeletion $true

#Protect all AD objects from accidental deletion
Get-ADobject -filter * | Set-ADObject -ProtectedFromAccidentalDeletion $true