Redmond Protocols Plugfest 2016 Randy Dong AD Family and BYOD Protocol Test Suite Updates Software Engineer

Agenda AD Family Protocol Test Suite Overview Updates BYOD Protocol Test Suites Overview Updates How to use (demo on MS-ADFSPIP test suite) Q&A

AD Family Protocol Test Suite

Test Suite Overview MS-ADTS-Schema MS-ADTS-LDAP MS-ADTS-PublishDC MS-ADTS-Security MS-SAMR MS-LSAD MS-LSAT MS-DRSR MS-FRS2 MS-NRPC MS-APDS All-in- One

ClassAttribute domainDNSmsDS-ExpirePasswordsOnSmartCardOnlyAccounts topmsDS-ObjectSoa msDS-SourceAnchor msDS-AuthNPolicymsDS-ServiceAllowedNTLMNetworkAuthentication msDS-UserAllowedNTLMNetworkAuthentication msDS-StrongNTLMPolicy securityPrincipalmsds-tokenGroupNames msds-tokenGroupNamesGlobalAndUniversal msds-tokenGroupNamesNoGCAcceptable Test Suite Updates - I MS-ADTS-Schema Upgraded schema version numbers (AD DS: 87, AD LDS: 31) Added test cases to validate new added schema attributes

Test Suite Updates - II MS-SAMR Added test cases for Non-DC configuration MS-DRSR Added test cases for new response message version for method IDL_DRSGetNCChanges Added test cases for new methods: IDL_DRSReadNgcKey, IDL_DRSWriteNgcKey Test Suite bugs fixed

BYOD Protocols

Protocol Overview Federation Server Farm Active Directory Contoso Company [MS-DVRD] [MS-OAPX] [MS-DVRE] [MS-DVRJ] File Sync Server Company Device Personal Device [MS-ECS] Web Application Server [MS-ADFSPIP] Azure Active Directory Federated Trust [MS-MDE] IT Admin [MS-MDM] Add Device Object Compliance Policies Proxy Allow information workers to access their individual data … that is centrally located on a traditional file server … from all of their devices … from wherever they are … while remaining in compliance with the corporate policies

Test Suites Overview 5 Test Suites: MS-DVRD-DVRE MS-OAPX MS-ECS MS-ADFSPIP MS-MDM-MDE Protocols: [MS-DVRD], [MS- DVRE] [MS-OAPX] [MS-ECS], [MS- FSVCA] [MS-ADFSPIP] [MS-MDM], [MS-MDE]

MS-ADFSPIP Pre-authentication for HTTP Basic application publishing New test cases were added Propagation of client IP address to backend applications Added validation check for the new HTTP header: X-MS-ADFS-Proxy-Client-IP New AD FS configure properties added Enabled user to configure AD FS behavior level in test suite Test Suite bugs fixed Test Suites Updates Web Application ProxyBrowser Federation Server Farm HTTP Request HTTP 302 Personal Device HTTP Basic (Credentials) Credentials Web Application Server Client IP Address New for Windows Server 2016 SAML WS-Fed OAuth SSL/TLS

MS-ADFSPIP Demo

Test Topology and Scenarios Federation Server Farm Contoso Company Personal Device Web Application Server Web Application Proxy Scenario 1: Deploy Web Application Proxy 1. Establish Trust 2. Get Service Configuration 3. Get Proxy Configuration Scenario 2: Manage Web Applications 1. Get relying party trusts 2. Add/Delete publish settings for the relying party Scenario 3: Pre-authenticate User Request 1. HTTP Request 2. Pre-authenticate SAML WS-Fed OAuth HTTP Basic 3. Authenticated Request 4. Update Proxy Configuration

Test Methodology Federation Server Farm Contoso Company Personal Device Web Application Server Web Application Proxy 1.Synthetic Client and Server Combined (Depend on Testing Scenario) 2.SUT Control Adapter (PowerShell/Interactive) 3.Everything in the same network (For simplicity) 4.Replace SUT (Web Application Proxy) and configure Test Suite Trigger Test Suite (Synthetic Server) Scenario 1: Deploy Proxy Scenario 2: Manage Applications Scenario 3: Pre-authentication Test Suite (Synthetic Server) Test Suite (Synthetic Client) Test Suite

Demo

Redmond Protocols Plugfest 2016 Questions or Comments?

Redmond Protocols Plugfest 2016 Thank You!