Module: Deploy ADFS Load Balancing Services

In this module you will deploy simple load balancing of ADFS for internal users. No proxy services are needed for internal users.

Change Client to Point at BIG-IP Load Balancing Virtual Server

  1. Double click the BIG-IP ADFS Load Balancer desktop shortcut

image0

  1. You should see that the HOSTS file now points ADFS at the load balancing virtual server (which is not yet created)

image1

  1. Close any open Chrome incognito windows
  2. Open a new Chrome window if not already open.
  3. Right click the “ADFS Demo App shortcut” and open a new incognito window
    1. It should fail because you cannot access ADFS through the BIG-IP until you deploy the configuration.
    2. If it is still working, you may need to close Chrome and/or retry the HOSTS file shortcut.

Deploy ADFS iApp for ADFS Load Balancing

  1. Open the BIG-IP configuration interface
  2. Open Local Traffic -> Virtual Servers and notice nothing is deployed
  3. Open iApps -> Application Services -> Applications
  4. Click Create

Accept all default values except for those listed below.

  1. Name: adfs-lb
  2. Template: f5.microsoft_adfs.v1.2.0rc7
  3. SSL Encryption
    1. How should the BIG-IP system handle SSL traffic?
      1. Encrypted traffic is forwarded without decryption (SSL pass-through)

SSL Pass-Through is chosen because Microsoft requires it for supported load balancing of ADFS. SSL Bridging breaks the connectivity between WAP servers and ADFS servers because client certificate authentication is required. You can use SSL Bridging if you will not point WAP servers at your deployment but following Microsoft’s guidelines and using SSL Pass-Through is recommended.

  1. High Availability
    1. What IP address do you want to use for the virtual server?
      1. 10.1.20.100

10.1.20.x is the internal network in this environment.

  1. Which FQDN will clients use to access AD FS?
    1. adfs.vlab.f5demo.com
  2. Which servers should be included in this pool?
    1. 10.1.20.6
    2. Click Add
    3. 10.1.20.7

image2

  1. Click Finished

Test the ADFS Load Balancing Functionality

  1. Close any open Chrome incognito windows
  2. Open a new Chrome window if not already open
  3. Right click the “ADFS Demo App” shortcut and open in an incognito window

image3

  1. You should see a set of claims displayed in the claims app at app.vlab.f5demo.com

image4

  1. Note that ADFS is still identifying the user as inside the corporate network because the user did not go through an MS-ADFSPIP compliant proxy solution.
  2. What happened:
    1. You made a request to App
    2. App redirected you to ADFS for authentication
    3. The BIG-IP received the request and load balanced it to one of the ADFS servers (this is the only change from last time)
    4. ADFS authenticated you automatically with Windows Integrated Authentication with your domain joined computer
    5. ADFS redirected you back to App with a WS-Fed assertion
    6. App validated the assertion and displayed the claims it received from ADFS

Review the ADFS Load Balancing Configuration

  1. Go to Local Traffic -> Virtual Servers
  2. Notice there are two deployed, one on port 443 and one on port 49443
    1. 443 is for ADFS traffic
      1. Pool members use port 443
    2. 49443 is for client certificate auth support
      1. Pool members use port 49443
Previous Next