Office 365 and Azure with ADFS setup or AD Pass-through authentication ?

Senior IT System Engineer
Senior IT System Engineer used Ask the Experts™
on
Hi People,

Is there any other alternative method that is easier to setup & configures rather than deploying ADFS server?

I heard about Azure AD Pass-through authentication, but not sure if it is ready for production implementation yet or not.

What's the minimal amount of server deployed in my VMware environment (OnPremise) to make it redundant?

Any help would be greatly appreciated.

Thanks.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2018
Commented:
What is your goal? ADFS has never been a requirement for office 365.

Author

Commented:
I want to do SSO and client authentication for some service that has been deployed by the developers in Azure.
So that the existing AD account can be used to access it as well as the same AD account for Office 365.
Distinguished Expert 2018
Commented:
True SSO requires ADFS. Pass -through is still in preview (last I checked), but operates more similarly to password syncing anyways, which is "same" sign-on, but not true SSO.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
OK, so in this case, there is no other way than to use ADFS servers deployed in both Azure and the OnPremise VMware server ?
what server that I need to deploy or separate?

OnPrem:
1x Windows Server 2012 R2 - Domain Joined - Federation Server
1x Windows Server 2012 R2 - Non-Domain Joined (DMZ) - WebApplication Server & SQL Server Express Edition

Azure:
1x Windows Server 2012 R2 - Domain Joined - Federation Server
1x Windows Server 2012 R2 - Non-Domain Joined (DMZ) - WebApplication Server & SQL Server Express Edition

Is that correct minimum 4x servers ?
Distinguished Expert 2018
Commented:
Ii can't speak to how many or where. That is entirely dependent on your app needs and architecture. You may not need any in Azure, or you may need more than one. These are significant architectural planning assessments and requires more than an EE question.

Author

Commented:
OK, so for the basic redundancy I will need to deploy:

OnPrem:
2x Windows Server 2012 R2 - Domain Joined - Federation Server
2x Windows Server 2012 R2 - Non-Domain Joined (DMZ) - WebApplication Server & SQL Server Express Edition

is that correct?
Distinguished Expert 2018
Commented:
I can't speak to why you are installing a web application server or SQL server in the DMZ. That seems out of scope to the question. But for redundancy, you'd want two ADFS servers and two proxy servers.

Author

Commented:
Chris,

Yes, you are right:

OnPrem:
2x Windows Server 2012 R2 - Domain Joined - AD Federation Server & SQL Server Express Edition on each server.
2x Windows Server 2012 R2 - Non-Domain Joined (DMZ) - WebApplication Server.

is that correct?
Distinguished Expert 2018
Commented:
I assume by web application server, you actually mean web application proxy. If so, then yes.

Author

Commented:
Yes, that's what I mean:

OnPrem:
2x Windows Server 2012 R2 - Domain Joined - AD Federation Server & SQL Server Express Edition on each server.
2x Windows Server 2012 R2 - Non-Domain Joined (DMZ) - WebApplication Proxy Server.

so the server is just standalone (not clustered) and the DMZ server is not joined to the AD domain.
Distinguished Expert 2018

Commented:
Correct.
I see you have listed using the Windows Internal DB for ADFS which is fine but just make sure you understand the pros and cons of does WID over SQL before you setup your environment. Also have you planned out your certificate needs which is huge which ADFS and needs to be planned out carefully.

http://www.be-com.eu/?p=873

Author

Commented:
Hi Compdigit44,

So in this case, shall I use single SQL express for my two ADFS server or two SQL express database rubbing in each ADFS server ?

My understanding is that when the SQL DB is down the whole company cannot authenticate to azure or office 365.

As for the SSL Certs it will be installed on both WebApplication Proxy server.
Do I need a load balancer for this Setup or can I use DNS round robin ?

Author

Commented:
Thanks !

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial