AD FS Requirements
Having provided that link to the official documentation, I'll sumarize some key points here:
- ADFS servers must be domain members.
- The domain functional level must be at Windows 2003 (native) at least.
- As mentioned in the previous blog post, the name on the certificate should not be the name of the ADFS server itself (this can cause SPN problems).
- We must create a service account for ADFS. It must have local administrator privileges on the ADFS server(s) but simple domain user status will suffice otherwise. Group managed service accounts can be used (optionally). In that case, there must be at least oneWindows 2012 R2 domain controller.
First, open Server Manager and select the "Add Roles and Features" link:
Select "Role-based or feature-based" installation:
Select the destination server (in my case, ADFS-1.mynet.lan):
Select the ADFS role:
Simply click on "Next" for Features (there is nothing to add here):
Some information on ADFS is provided:
ADFS is installed:
We will now create the first federation (ADFS) server in our server farm:
Note: the account must be a member of the domain administrators group at least.
The first part of the federation name is typically sometime like...
- sts (that means "security token service").
Note: there is an error because it cannot be determined if gMSA is available. Since we are not using Group Managed Service Accounts, we can ignore this error.
After selecting the account, I enter the password for the account:
The configuration assistant verifies certain pre-requisites. If the verification is successful, we can click on "Configure":
If all goes well, we should see this message: