Where should I put ADFS at?

hi everyone,

hope can help. have no experience in installing or setting adfs..but need 1 project antoher vendor need access our ad. can find instructions in how setup adfs...very easy follow. have questions:

-should put in dmz? or not necessary? 

- if above true, tcp/udp ports should open on firewall?

- shoudl install in on same box dc is?

- other security issue need pay attention on?

hope can , share experience.

thank you!

takami

hi,

microsoft published several articles topic (e.g. http://technet.microsoft.com/en-us/library/dn554245.aspx). not want rephrase them here , rather answer specific questions:

- should put in dmz? or not necessary? 

in dmz should install adfs proxy server (in 2012 r2 called/part of web application proxy role

- if above true, tcp/udp ports should open on firewall?

publish adfs on ssl, port 443 internet adfs proxy server, , adfs proxy server adfs serer required. nothing else inbound traffic. outbound servers might need contact ntp server, windows update etc.

- shoudl install in on same box dc is?

depends on how big organization , on operational constraints. if right in windows 2008 r2 not support working. might have reboot dc more because of additional patches coming ms.

- other security issue need pay attention on?

2048bit ssl certificates, 1 adfs proxy server(s), 1 adfs server(s). reduce number of people being local admins on adfs server(s) because these can copy signing key , way run own service home. signing key can stored in hsm (hardware security module) nothing cheap. 

hope helps,

lutz

 

Windows Server  >  Security