AWS Managed Microsoft AD環境でADFSサーバーを構築する

New-ADServiceAccount -Name 'adfs-service' –DNSHostName 'adfs01'

$params = @{
    Subject = 'sts.shibata.tech'
    DnsName = 'sts.shibata.tech'
    CertStoreLocation = 'cert:\LocalMachine\My'
    KeyAlgorithm = 'RSA'
    KeyLength = 2048
    KeyExportPolicy = 'Exportable'
    NotAfter = (Get-Date).AddYears(5)
}
$cert = New-SelfSignedCertificate @params
$cert

# WAPおよびクライアント用にエクスポートしておく (要管理者権限)
# ※エクスポート先およびパスワードは適当なので適宜変更してください
mkdir C:\Temp
Export-PfxCertificate -Cert $cert -FilePath "C:\temp\adfs.pfx" -Password  (ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force)

Install-WindowsFeature -Name 'ADFS-Federation' -IncludeManagementTools

# gMSA専用関数
function New-NonDADkmContainerForgMSA {
    [CmdletBinding()]
    param (
       [Parameter(Mandatory=$True)]
       [string]$AcctToAclDkmContainer
    )

    $userNameSplit = $AcctToAclDkmContainer.Split("\")
    if ($userNameSplit.Length -ne 2)
    {
        Write-error "Specify non-DA local admin user in 'domain\username' format"
        return $false
    }

    # The OU Name is a randomly generated Guid
    [string]$guid = (New-Guid).Guid
    Write-Host ("OU Name" + $guid)

    $ouName = $guid
    $initialPath = "OU=$($userNameSplit[0])," + (Get-ADDomain).DistinguishedName
    $ouPath = "CN=ADFS," + $initialPath
    $ou = "CN=" + $ouName + "," + $ouPath

    Write-Host ("Creating organizational unit with DN: " + $ou)

    if ($null -eq (Get-ADObject -Filter {distinguishedName -eq $ouPath}))
    {
        Write-Host ("First creating initial path " + $ouPath)
        New-ADObject -Name "ADFS" -Type Container -Path $initialPath
    }
    New-ADObject -Name $ouName -Type Container -Path $ouPath

    # get gMSA SID
    $strSID = (Get-ADServiceAccount -Identity $userNameSplit[1]).SID

    # set acl to ADFS cottainer object
    Import-Module ActiveDirectory
    try {
        Push-Location ad:
        [System.DirectoryServices.ActiveDirectorySecurityInheritance]$adSecInEnum = [System.DirectoryServices.ActiveDirectorySecurityInheritance]::All
        $ace1 = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $strSID,"GenericRead","Allow",$adSecInEnum
        $ace2 = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $strSID,"CreateChild","Allow",$adSecInEnum
        $ace3 = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $strSID,"WriteOwner","Allow",$adSecInEnum
        $ace4 = New-Object System.DirectoryServices.ActiveDirectoryAccessRule $strSID,"DeleteTree","Allow",$adSecInEnum

        $acl = Get-Acl -Path $ou

        $acl.AddAccessRule($ace1)
        $acl.AddAccessRule($ace2)
        $acl.AddAccessRule($ace3)
        $acl.AddAccessRule($ace4)

        Set-Acl -Path $ou -AclObject $acl
    } finally {
        Pop-Location
    }

    return @{"DKMContainerDn" = $ou}
}

# ADFSコンテナーを作成し、設定情報を変数に格納
# ※ $adminConfig 変数は後で使用する
$adminConfig = New-NonDADkmContainerForgMSA 'corp\adfs-service'

# 証明書情報を取得
$cert = Get-ChildItem Cert:\LocalMachine\My\ | Where-Object { $_.Subject -eq 'CN=sts.shibata.tech' }

# ADFSファームを構築する際のローカル管理者権限を持つユーザーの認証情報
$localAdminCred = Get-Credential 'corp\admin'

# SigningCertificateThumbprint, DecryptionCertificateThumbprint を指定してADFSファームを作成
$params = @{
    CertificateThumbprint = $cert.Thumbprint
    SigningCertificateThumbprint = $cert.Thumbprint
    DecryptionCertificateThumbprint = $cert.Thumbprint
    FederationServiceName = 'sts.shibata.tech'
    GroupServiceAccountIdentifier = 'corp\adfs-service$'
    Credential = $localAdminCred
    OverwriteConfiguration = $true
    AdminConfiguration = $adminConfig
    Verbose = $true
}
# 検証
Test-AdfsFarmInstallation @params
# インストール
Install-AdfsFarm @params

<ADFS01のIP> sts.shibata.tech

# エクスポートした証明書が C:\temp\adfs.pfx にある前提
$params = @{
    FilePath = 'C:\temp\adfs.pfx'
    CertStoreLocation = 'cert:\localMachine\my'
    Password = (ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force)
}
Import-PfxCertificate @params

Install-WindowsFeature Web-Application-Proxy -IncludeManagementTools

# ローカル管理者権限を持つユーザーの認証情報
$localAdminCred = Get-Credential 'corp\admin'
$params = @{
    FederationServiceName = 'sts.shibata.tech'
    CertificateThumbprint = (Get-ChildItem Cert:\LocalMachine\My\ | Where-Object { $_.Subject -eq 'CN=sts.shibata.tech' }).Thumbprint
    FederationServiceTrustCredential = $localAdminCred
}
Install-WebApplicationProxy @params