Introduction

This document provides instructions on how to configure Hybrid Azure AD join by using IBM® Security Verify as the Identity Provider.
The following Prerequisites must be met before configuration:

• Azure AD with administrator access.
• Windows AD server e.g. Windows Server 2019 Datacenter edition, installed with Azure AD Connect.
• Windows 10 device domain joined to Windows AD domain.
• Windows device with Powershell and Microsoft Online Services Module installed.
• IBM Security Verify domain with administrator access.

Complete the following tasks:

• Azure Active Directory
  • Configure a federated Azure AD Domain.
• On-premise Microsoft® Active Directory
  • Setup the On-premise Active Directory.
  • Setup Azure AD Connect.
  • Enable Kerberos Authentication.
• IBM Security Verify
  • Configure Microsoft 365 application (WS-Federation).

Configure a federated Azure AD domain

Refer to the Microsoft 365 WS-Federation single sign-on (SSO) configure guide with the following steps:

1. Open IBM Security Verify Admin portal.
2. Click Applications.
3. Create a new Microsoft 365 application or select an existing Microsoft 365 application.
4. Click the Sign-on tab, and select WS-Federation as the Sign-on method.
   The guide is displayed on the right panel.

Configure On-premise Active Directory

Note: The following instructions are based on a fresh installed Windows Server 2019 Datacenter edition with the latest updates installed.

Add Active Directory Role to Windows Server

1. From the Server Manager, click Manage and select Add Roles and Features from dropdown to launch Add Roles and Features Wizard.

2. In the Add Roles and Features Wizard, click Next.
3. In the Select server Roles window, select the Active Directory Domain Services checkbox and click Add Features in the pop-up window.

4. In the Select features window, click Next.
5. In the Confirmation page, click Install.

6. After the installation is complete, close the Add Roles and Features Wizard.

Configure Active Directory

1. From the Server Manager, click the notification icon and select Promote this server to a domain controller.

2. In the Active Directory Domain Services Configuration Wizard, under Deployment Configuration, select Add a new forest and specify the domain name.

The domain name is the one that is used in Configure a federated Azure AD domain.
3. In the Domain Controller Options window, use the default options and specify a Directory Service Restore Mode (DSRM) password. Click Next to proceed.

4. In the Additional Options window, change the NetBIOS domain name if necessary.

5. Click Next for the rest of the windows.
6. In the Installation window, click Install. The Windows Server restarts automatically after the installation is completed. If it does not restart automatically, restart it manually.

Test join to the On-premise Active Directory from a Windows 10 device (Optional)

Creating a new domain user for domain join

1. From Administrative Tools, open Active Directory Users and Computers and expand your domain.
2. Right-click Users and select New > User.

3. Specify the required information to create the user.

Join the Windows Domain

Note:

• Windows 10 Home Edition does not support domain join, use Windows 10 Professional or Enterprise or Educational edition.
• The Windows AD configured in Configure On-premise Active Directory must be used as a DNS of Windows 10 device. Change the Windows 10 device network configure accordingly.

1. Sign in to the Windows 10 device.

2. Open Settings, select Accounts> Access work or school.

3. Click Connect.

4. Select Join this device to a local Active Directory domain.

   

   1. Enter the Domain name you have configured in Configure AD.

      

   2. Enter the credentials from Create a new domain user for domain join and click OK.

      

   3. Click Next or Skip

   4. Click Restart now.

5. Verify that the Windows 10 device is part of the domain after restarting.

   1. The following screen appears after restarting. The domain name is the NetBIOS domain name.

      

   2. Ensure that the sign in to Windows with the domain user is successful.

Installing and Configuring Azure AD Connect on the On-premise Active Directory

Installing Azure AD Connect

1. Download the Azure AD Connect installer from https://www.microsoft.com/en-us/download/details.aspx?id=47594.
2. Double-click the installer to start the installation.
3. In the Welcome window, agree to the license terms and privacy notice.
4. Click Continue.

5. In the Express Settings window, click Customize.

6. In the Required Components window, click Install without selecting any options.

7. Wait for the installation of the optional components to complete.

8. Configure Azure AD Connect:

   1. In the User Sign-in window, select Do not configure.

      

   2. In the Connect to Azure AD window, specify your AAD Admin login credential.

      

   3. Click Sync > Connect Directories, select the On-premise Active Directory domain name for the FOREST, and click Add Directory.

   4. Select Create new AD account and specify the On-premise Active Directory domain Admin (The Windows AD Server administrator user) credential at the popup windows.

      

9. Do not change the remaining options and click Next for the rest of the pages.

10. Click Install.

Configuring Azure AD Connect for hybrid Azure AD join

1. Launch Azure AD Connect by double-clicking the desktop icon.
2. In the Welcome window, click Configure.

3. In the Tasks window, select Configure device options and click Next.

4. In the Overview window, click Next.
5. In the Connect to Azure AD page, enter the AzureAD Admin credential.
6. In the Device options window, select Configure Hybrid Azure AD join and click Next.

7. In the Device systems window, select both options and click Next.

8. In the SCP window, select the checkbox next to the domain name.
9. Select the IBM Security Verify tenant name for Authentication Service and click Add.
10. Specify the On-premise Active Directory domain Admin (The Windows AD Server administrator user) credential and click Next.

11. Click Next for the rest of the pages and click Configure.
12. Click Exit after the configuration is completed.

Configuring Controlled validation of hybrid Azure AD join

Refer to this Microsoft document Controlled validation of hybrid Azure AD join.

Clearing the SCP from AD

See Clear the SCP from AD.

Configuring client-side registry setting for SCP

See Configure client-side registry setting for SCP.

Skip the remaining part of this Microsoft document Controlled validation of hybrid Azure AD join.

Validating Hybrid Azure AD Join on an On-premise Active Directory domain joined Windows 10 device (Optional)

Join to the On-premise Active Directory Domain

Refer to Test join to the On-premise Active Directory from a Windows 10 device (Optional) section to join a Windows 10 device to local AD domain.

Wait for the Windows 10 device status become Hybrid Azure AD Joined

It can take up to 30 minutes to synchronize the newly On-premise Active Directory Domain joined Windows 10 device to Azure AD.
It might take another 30 minutes or more for the device to complete Hybrid Azure AD join after it is synchronized to Azure AD.

Note: Try rebooting the Windows 10 device and sign-in again if Hybrid Azure AD join is not fully completed after a long time.

• Check Windows 10 device Hybrid AAD join status by using command line dsregcmd /status on the Windows 10 device:

  • After On-premise Active Directory Domain join, before Hybrid Azure AD join is fully completed, the device state is:
    AzureADJoined: NO
    DomainJoined: YES

    

  • After Hybrid Azure AD join is fully completed, the device state is:
    AzureADJoined: YES
    DomainJoined: YES

    

• Check Windows 10 device Hybrid Azure AD join status in the Azure portal:
  After the On-premise Active Directory Domain joined device is synchronized to AAD, the device appears in Azure portal - Azure Active Directory - Devices.

  • Before Hybrid Azure AD join is fully completed, the device state Registered column is Pending.

    

  • After Hybrid Azure AD join is fully completed, the device state Registered column is date and time on which Hybrid AAD join is fully completed.

    

Configuring Service Principal Name (SPN) and Keytab file to enable Kerberos Authentication

Creating a Service Account User on Windows AD Server

Refer to Create a new domain user for domain join section on how to create a new domain user.

When you are creating a password for the service account, uncheck User must change password at next logon and check Password never expires.

Enabling Kerberos AES encryption for the Service Account User (Optional)

1. Right-click the newly created Service Account User and select Properties.
2. On the Account tab, in Account options select This account supports Kerberos AES 128 bit encryption. and/or This account supports Kerberos AES 256 bit encryption.

3. Click OK to save the change.

Finding out the DNS A record of the IBM Security Verify tenant hostname

The DNS A record of the IBM Security Verify tenant hostname must be used to configure the Service Principal Name (SPN) and create the Kerberos keytab file.

Refer to Linux / MacOS or Windows to find out the DNS A record.

Linux / MacOS

1. Open terminal and execute the following command:
   dig <ISVTenentHostName>
2. From the output, under the ;; ANSWER SECTION: section, there are lines in this format <FQDN>. 4 IN A <IP>, where the <FQDN> is the DNS A record for the IBM Security Verify tenant hostname.
   Note: Remove the '.' (dot) at the end of the DNS A record.

Windows

1. Open PowerShell and execute the following command:
   nslookup <ISVTenentHostName>.
   Note: In the command line, a '.' (dot) must be appended after the IBM Security Verify Tenant Hostname without space.
2. From the output, under Non-authoritative answer:, there is a line starts with Name:, the value after Name: is the DNS A record for the IBM Security Verify tenant hostname.

Configuring Service Principal Name (SPN)

Open PowerShell and execute the following command to configure an SPN for the service account.
The SPN must be set to ISV WSFed app configure.

setspn -S HTTP/<ISVTenantHostName_DNS_A_RECORD> <ServiceAccountName>

(Optional) Verify the Service Account has the required servicePrincipalName attribute with a valid value. Enter the following command:

setspn -L <ServiceAccountName>

6.4 Configuring the Keytab file

Open a PowerShell console, and run the following command to configure the Keytab file.
The Keytab file is the must be uploaded to ISV WSFed app configure.

NOTE: Use uppercase for DOMAINNAME.

ktpass /out <FullPathToKeytabFile> /princ HTTP/<ISVTenantHostName_DNS_A_RECORD@DOMAINNAME> /mapuser <ServiceAccountName> /pass <ServiceAccountNamePassword> /pType KRB5_NT_PRINCIPAL

If encryption is needed, additional parameters can be appended to the end of the command:

• For AES128: append /crypto AES128-SHA1.
• For AES256: append /crypto AES256-SHA1.
  Refer to Microsoft document ktpass for ktpass command details.

Optional Step: Configure keytab file to contain multiple SPNs.

Pre-condition: an existing keytab file contains one or more SPNs.
To add a SPN for the ServiceAccount into the existing keytab file, run the following command:

ktpass /in <FullPathToOriginalKeytabFile> /out <FullPathToNewKeytabFile> /princ HTTP/<ISVTenantHostName_DNS_A_RECORD@DOMAINNAME> /mapuser <ServiceAccountName> /pass <ServiceAccountNamePassword> /pType KRB5_NT_PRINCIPAL

If /in and /out are the same file, the existing keytab file is overwritten.

Configuring IBM Security Verify tenant URL to Intranet zone using Group Policy Object

1. Open the Group Policy Management.

2. Edit the Client Side SCP group policy object that is created in Configure client-side registry setting for SCP.

   

3. Select Policies > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page.

4. Edit Site to Zone Assignment List.

5. Enable the policy and click Show under Options.

6. Enter the IBM Security Verify tenant URL to Value name (the URL shall start with https://), enter 1 to Value.

7. Save and close. Ensure that the Client Side SCP group policy object is linked to the domain.
   This should have already been completed in Configure client-side registry setting for SCP.

Enabling Kerberos authentication for IBM Security Verify Microsoft 365 application (WS-Federation)

Kerberos authentication can be enabled by using either IBM Security Verify WebUI or API.

• Refer to Using WebUI to enable Kerberos authentication using WebUI.
• Refer to Using API (curl) to enable Kerberos authentication using API.

Using WebUI

If there is an existing Microsoft 365 application (WS-Federation), refer to Update an existing Microsoft 365 application (WS-Federation).
Otherwise, refer to Create new Microsoft 365 application (WS-Federation).

Update an existing Microsoft 365 application (WS-Federation)

1. Login to the IBM Security Verify Admin portal.
2. Click Applications.
3. Find the Microsoft 365 application to update from the list and click the gear icon on the right of the row to change the application settings.
4. Click the Sign-on tab. Ensure that the Sign-on method is WS-Federation.
5. At the Upload keytab file section, click Select keytab file and select the keytab file to use.
6. At the Service principal names section, enter the SPN to use.
7. If the Federate multiple domains for Microsoft 365 is checked, multiple SPNs can be added.
   Note: Ensure that the keytab file contains all the SPNs.
8. Click Save. The sha256 checksum of the uploaded keytab file is displayed after saving.

Create new Microsoft 365 application (WS-Federation)

1. Login to the IBM Security Verify Admin portal.
2. Click Applications.
3. Click Add application.
4. Select Microsoft 365 from the Select Application Type list and click Add application.
5. Fill in the information on General tab.
6. Click the Sign-on tab and select WS-Federation for Sign-on method. Provider ID and WS-Federation end point of the application are not changed. Ensure that the correct certificate is selected for Signature Certificate.
7. Select the attribute to be used for Name identifier under SAML subject.
8. Select the attributes to be used for UPN and ImmutableID under Attribute mappings. Additional attribute mappings can be added here if needed.
9. Click Select keytab file and select the keytab file to use.
10. In the Service principal names section, enter the SPN to use.
11. If Federate multiple domains for Microsoft 365 is checked, multiple SPNs can be added.
    Note: make sure the keytab file contains all the SPNs.
12. Click Save button at the bottom right of the page.
13. Configure the Access Type at Entitlements tab.
14. Click Save.

Provisioning on-premises Microsoft Active Directory users into IBM Security Verify

Refer to Active Directory provisioning.

Validating Kerberos authentication by enabling OneDrive Silent Configuration (Optional)

OneDrive silent configure can be used to verify if Kerberos authentication is correctly configured.

For more information, see:

• https://docs.microsoft.com/en-us/onedrive/use-group-policy
• https://docs.microsoft.com/en-us/onedrive/use-group-policy#silently-sign-in-users-to-the-onedrive-sync-app-with-their-windows-credentials

Obtaining the OneDrive Administrative Template and install it to the Windows AD server

Refer to https://docs.microsoft.com/en-us/onedrive/use-group-policy to obtain the OneDrive Administrator Template files, and copy them to the Windows AD server.

1. Open File Explorer, specify \\<domainName>\SYSVOL\<domainName>\Policies in the address bar.
2. Right-click and create a folder PolicyDefinitions.

3. Open PolicyDefinitions folder and copy the OneDrive Administrator Template files into PolicyDefinitions.

4. Create a en folder under PolicyDefinitions.
5. Copy OneDrive.adml into the en folder.

Configuring Group Policy Object to Enable OneDrive Silent Configuration

1. Open the Group Policy Management.
2. Right-click Group Policy Object and select New.

3. Name it OneDrive Silent Config.

4. Edit the OneDrive Silent Config group policy object.

5. Select Policies > Administrative Templates > OneDrive, change policy Silently sign in users to the OneDrive sync app with their Windows credentials to Enabled.

6. Save and close.
7. Link the OneDrive Silent Config group policy object to the domain.

Validating OneDrive Silent Configuration is enabled on a Windows 10 device

Ensure that the Windows 10 device is On-premise Active Directory Domain joined.
A reboot of the Windows 10 device might be required in order to obtain the latest Group Policy from the Windows AD server.
Login the Windows 10 device as a domain user. There is a notification from OneDrive if the Kerberos authentication configure is correct.

The name displayed on the OneDrive notification is the AzureAD tenant name.