Working Hard In IT - My view on IT from the trenchesWorking Hard In IT | My view on IT from the tre

Time 2021-09-17 18:32:51

Web Name: Working Hard In IT - My view on IT from the trenchesWorking Hard In IT | My view on IT from the tre

WebSite: http://blog.workinghardinit.work

ID:195792

Keywords:

IT,My,In,

Description:

IntroductionThe registry value LDAP_ALTERNATE_LOGINID_ATTRIBUTE is a gem. It is found under the HKLM\SOFTWARE hive in the key \Microsoft\AzureMfa. It plays a critical part to get the NPS extension for Azure MFA to work in real-life scenarios. LDAP_ALTERNATE_LOGINID_ATTRIBUTE is a gem For the NPS extension for Azure MFA to work we need to have a match between the User Principal Name (UPN) in the on-premises Active Directory and in Azure Active Directory (AzureAD). The mapping between those two values is not always one on one. You can have Azure AD Connect use different a attribute to populate the Azure Active Directory UPN than the on-premises UPN.There are many reasons you can need to do so and it happens a lot in real-world environments. Changing a UPN is possible but not always in the manner one wants. Sometimes these reasons are technical, political, or process-driven. In the end, you don t want to break other processes, confuse your users or upset the powers that be. No matter what the reason, what can you don when you cannot change the UPN to make them match up?LDAP_ALTERNATE_LOGINID_ATTRIBUTE is a gemWhen you have installed the NPS extension for Azure MFA you will find part of its configuration in the registry. In there you can add values or leverage existing ones. One of those is LDAP_ALTERNATE_LOGINID_ATTRIBUTE. It allows using the NPS extension for Azure MFA despite the fact the UPN for users does not match between on-premises Active Directory and the UPN in Azure Active Directory.What it does is instead of sending the on-premises UPN to Azure AD it uses an alternate value. The trick is the select the attribute that was used to populate the Azure AD UPN in scenarios where these do not match. In our example that is the mail attribute.AD connect uses the mail attribute to populate the Azure AD UPN for our users. So we have [email protected] there.AD DS mail attribute set to a different value than the UPN.In our example here we assume that we cannot add an alternate UPN suffix to our Active Directory and change the users to that. Even if we could, the dots in the user name would require a change there. That could get messy, confuse people, break stuff etc. So that remains at [email protected]Our AD DS UPN is set to the domain name suffix and the account name has no dots.When we have the NPS extension for Azure MFA set up correctly and functioning we can set the LDAP_ALTERNATE_LOGINID_ATTRIBUTE to mail and it will use that to validate the user in Azure and send an MFA challenge.LDAP_ALTERNATE_LOGINID_ATTRIBUTE to the rescueNeed help configuring the NPS extension for Azure MFA ?By the way, if your need help configuring the NPS extension for Azure MFA you can read these two articles for inspiration.Transition an RD Gateway to Use the NPS Extension for Azure MFA | StarWind Blog (starwindsoftware.com)Install and Configure the NPS Extension for Azure MFA | StarWind Blog (starwindsoftware.com)ConclusionThere are a lot of moving parts to get an RD Gateway deployment with NPS extension for Azure MFA to work. It would be a pity to come to the conclusion it takes a potentially disruptive change to a UPN, whether on-premises and/or in Azure is required for it to work. Luckily there is some flexibility in how you configure the NPS extension for Azure MFA via its registry keys. In that respect, LDAP_ALTERNATE_LOGINID_ATTRIBUTE is a gem!MFA for a highly available RD GatewayRecently I decided to write up a couple of articles on how to set up MFA for a highly available RD Gateway. Why? Because so much information on the internet is fragmented and as such incomplete. So I wanted a reference document for myself. As I was making that document I realized I needed to explain the why and not just the how. The why is what helps people support and troubleshoot the solution during its life cycle.The above, in combination with me being a verbose son of * led to 44 pages of information. So, I decided to publish it as a two-part article series.Figure 1: MFA for a highly available RD GatewayYou can find the articles here Transition a Highly Available RD Gateway to Use the NPS Extension for Azure MFA – Phase I and Transition a highly available RD Gateway to use the NPS Extension for Azure MFA – Phase II Why and when should you read them?If you have RD Gateway running and you have no MFA solution set up for it, I highly recommend you head over to read these two articles. That is especially true when your RD Gateways solution is a high availability (HA) deployment with an RD Gateway farm behind a load balancer. In that case, you want your MFA components to be HA as well! For some reason, so many guides on the internet ignore or brush over HA very cavalierly. That is one thing I hope these two articles remediate.Next to that, it has many details on every aspect of the deployment to make sure you get it up and running successfully and correctly.Finally, I present you with a collection of troubleshooting information and tools to help you figure out where the problem is so you can find a way to fix it.That s it. I really think it can help many of you out there. I hope it does.SMB over QUIC POCI have had the distinct pleasure of being one of the first people to implement a SMB over QUIC POC. It was in a proof of concept I did with Windows Server 2022 Azure Edition in public preview.That was a fun and educational excercise. As a result, I learned a lot. As a result, I decided to write a lab and test guide, primarily for my own reference. But also, to share my experience with others.So happy I did this POC and I am very happy with the results!You can read the lab guide in a two part series of articles. SMB over QUIC: How to use it – Part I | StarWind Blog (starwindsoftware.com) and SMB over QUIC Testing Guide Part II | StarWind Blog (starwindsoftware.com)I am convinded it will fill a need for people that require remote access to SMB file shares without a VPN. Next to that, the integration with the KDC proxy service make it a Kerberos integrated solution. In addition, the KDC Prosy service has the added benefit of allowing for remote password changes.If you need to get up to speed on what SMB over QUIC is all about I refer your to my article SMB over QUIC Technology | StarWind Blog (starwindsoftware.com). I m sure that will bring you up to speed.Finally, I hope you will find these articles useful. I m pretty sure they will help you with your own SMB over QUIC POC and testing.Thank your for reading!Microsoft and QUICIf you are interested in Microsoft and QUIC I have some good news for you. Recently a new article, SMB over QUIC Technology | StarWind Blog (starwindsoftware.com) was published. It is the first in a series about what Microsoft is working on in regards to QUIC. While not without some controversy, QUIC does a lot for a number of issues connectivity over the internet at large has been dealing with.It leverages UDP.TLS 1.3 is built into the protocol.Reduces RTT during connection encryption setup.Handles and optimizes flow control and loss recovery.QUIC reduces the round trips during the TLS handshake significantlyOver the internet, with mobile clients, this is a big deal. Since it is secure by default people really started thinking about where this can be used to improve things for all involved.I think QUIC is going to be more and more important in the future and this article positions QUIC in the Microsoft ecosystem. So, head over there, read it, and let me know what you think.TLS 1.3, QUIC, HTTP/3, and SMB 3.1.1 are shaking up things a bit by challenging TCP. Microsoft dropped QUIC into Windows Server 2022 Azure edition. That went into public preview last week and I dove in to the lab to figure out what I can do with it.As a technologist, I am having a lot of fun testing this out in the lab. Last weekend I was busy with SMB over QUIC and QUIC in IIS. I learned a lot and have made up my mind I can use this in the real world to solve requirements. I will share my findings and musing with you in near the future. But today, start with an introduction in SMB over QUIC Technology | StarWind Blog (starwindsoftware.com). The WorkingHardInIT blog is a non commercial blog where technical information is shared with the global community. We only store the minimal data need for the shortest amount of time to be able to run the website and let you interact with it. We never share and/or sell any personal or general information about this website to anyone.Cookies are used minimally where needed, which you can turn off at any time by modifying your internet browser’s settings.

TAGS:IT My In 

<<< Thank you for your visit >>>

My view on IT from the trenches

Hot Websites