Leverage the Mobile Device Extension for ad rms

Testing and evaluating the Mobile Device Extension for AD RMS

This walkthrough provides instructions for configuring the Mobile Device Extension for AD RMS in a Windows Server 2012 (R2) based environment. It is based on the “on-premises” test lab environment deployed in Azure as per previous sections. This environment satisfies all the prerequisites for the Mobile Device Extension.

Note For the purpose of this document, it leverages the Microsoft TechNet article Active Directory Rights Management Services Mobile Device Extension⁸⁰.

It consists in the following three steps that must be followed in order:

1. 
   Configuring AD FS for the Mobile Device Extension for AD RMS.
   
2. 
   Specifying the DNS SRV records for the Mobile Device Extension for AD RMS.
   
3. 
   Deploying the Mobile Device Extension for AD RMS.
   

The following subsections describe in the context of our test lab environment each of these steps.

Configuring AD FS for the Mobile Device Extension for AD RMS

Automatically configuring AD FS for the Mobile Device Extension

The configuration of AD FS for the Mobile Device Extension for AD RMS consists in creating a relying party trust for the Mobile Device Extension along with:

1. 
   An issuance transform rule that sources from AD DS and passes through the following claims for the authenticated user:
   

• 
  Primary email address (http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress)
  
• 
  User principal name (UPN) (http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn)
  
• 
  Proxy email addresses if present (http://schemas.xmlsoap.org/claims/ProxyAddresses)
  

2. 
   An authorization rule that permits the issuance of the above claims for all users.
   

To automatically configure AD FS in accordance, proceed with the following steps:

1. 
   Open a remote desktop connection on the ADFS1 computer as LITWARE369\AzureAdmin with “pass@word1” as password.
   
2. 
   Download on the Desktop the script Add-AdfsRelyingPartyTrust4TestLabEnvironment.ps1⁸¹ and unblock it so that it can comply with the above execution policy and be executed in your environment.
   

Note The content of the script Add-AdfsRelyingPartyTrust4TestLabEnvironment.ps1 is the copy of the content provided in the Microsoft TechNet article Active Directory Rights Management Services Mobile Device Extension⁸².
# This Script Configures the Microsoft Rights Management Mobile Device Extension and Claims used in the ADFS Server
# Check if Microsoft Rights Management Mobile Device Extension is configured on the Server

$CheckifConfigured = Get-AdfsRelyingPartyTrust -Identifier "api.rms.rest.com"

if ($CheckifConfigured)

{

Write-Host "api.rms.rest.com Identifer used for Microsoft Rights Management Mobile Device Extension is already configured on this Server"

Write-Host $CheckifConfigured

}

else

{

Write-Host "Configuring Microsoft Rights Management Mobile Device Extension "

# TransformaRules used by Microsoft Rights Management Mobile Device Extension

# Claims: Email, UPN and ProxyAddresses

$TransformRules = @"

@RuleTemplate = "LdapClaims"

@RuleName = "Jwt Token"

c:[Type ==

"http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",

Issuer == "AD AUTHORITY"]

=> issue(store = "Active Directory", types =

("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",

"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn",

"http://schemas.xmlsoap.org/claims/ProxyAddresses"), query =

";mail,userPrincipalName,proxyAddresses;{0}", param = c.Value);
@RuleTemplate = "PassThroughClaims"

@RuleName = "JWT pass through"

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]

=> issue(claim = c);

@RuleTemplate = "PassThroughClaims"

@RuleName = "JWT pass through"

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"]

=> issue(claim = c);

@RuleTemplate = "PassThroughClaims"

@RuleName = "JWT pass through Proxy addresses"

c:[Type == "http://schemas.xmlsoap.org/claims/ProxyAddresses"]

=> issue(claim = c);

"@

# AuthorizationRules used by Microsoft Rights Management Mobile Device Extension

# Allow All users

$AuthorizationRules = @"

@RuleTemplate = "AllowAllAuthzRule"

=> issue(Type = "http://schemas.microsoft.com/authorization/claims/permit",

Value = "true");

"@

# Add a Relying Part Truest with Name -"Microsoft Rights Management Mobile Device Extension" Identifier "api.rms.rest.com"

Add-ADFSRelyingPartyTrust -Name "Microsoft Rights Management Mobile Device Extension" -Identifier "api.rms.rest.com" -IssuanceTransformRules $TransformRules -IssuanceAuthorizationRules $AuthorizationRules
Write-Host "Microsoft Rights Management Mobile Device Extension Configured"

}

3. 
   Open a Windows PowerShell command prompt and run the following command to create the relying party trust named api.rms.rest.com:
   

PS C:\Users\AzureAdmin.LITWARE369> cd .\Desktop

PS C:\Users\AzureAdmin.LITWARE369\Desktop> .\Add-AdfsRelyingPartyTrust4TestLabEnvironment.ps1

Configuring Microsoft Rights Management Mobile Device Extension

Microsoft Rights Management Mobile Device Extension Configured

PS C:\Users\AzureAdmin.LITWARE369

Authorizing the RMS sharing app for your devices

To authorizing the RMS sharing app for your devices, proceed with the following steps:

1. 
   Open a remote desktop session if needed as LITWARE369\AzureAdmin.
   
2. 
   From the previous Windows PowerShell command prompt, run the following command(s):
   

For Android devices:
PS C:\users\AzureAdmin.litware369\Desktop> Add-AdfsClient -Name "RMS Sharing App for Android" -ClientId "ECAD3080-3AE9-4782-B763-2DF1B1373B3A" -RedirectUri @("com.microsoft.rms-sharing-for-android://authorize")

PS C:\users\AzureAdmin.litware369\Desktop>

For iPhone and iPad devices:
PS C:\users\AzureAdmin.litware369\Desktop> Add-AdfsClient -Name "RMS Sharing App for iOS" -ClientId "9D7590FB-9536-4D87-B5AA-FAA863DCC3AB" -RedirectUri @("com.microsoft.rms-sharing-for-ios://authorize")

PS C:\users\AzureAdmin.litware369\Desktop>

For Mac devices:
PS C:\users\AzureAdmin.litware369\Desktop> Add-AdfsClient -Name "RMS Sharing App for OSX" -ClientId "96731E97-2204-4D74-BEA5-75DCA53566C3" -RedirectUri @("com.microsoft.rms-sharing-for-osx://authorize")

PS C:\users\AzureAdmin.litware369\Desktop>

For Windows Phone devices:
PS C:\users\AzureAdmin.litware369\Desktop> Add-AdfsClient -Name "RMS Sharing App for WindowsPhone" -ClientId "6507DFAF-F19E-47C6-82C3-08AFEE79D74E" -RedirectUri @("com.microsoft.rms-sharing-for-wp://authorize")

PS C:\users\AzureAdmin.litware369\Desktop>

For Windows RT devices:
PS C:\users\AzureAdmin.litware369\Desktop> Add-AdfsClient -Name "RMS Sharing App for Windows RT" -ClientId "D27EA168-C4FE-41E7-8876-B47FF6376003" -RedirectUri @("com.microsoft.rms-sharing-for-WinRT://authorize")

PS C:\users\AzureAdmin.litware369\Desktop>

Note In order to allow access from OAuth 2.0 clients to REST resources secured by AD FS, the app have to be pre-registered with AD FS by using the cmdlet Add-AdfsClient⁸³. AD FS will not allow access to a REST resource to clients that specify a client identifier or redirection URI that are not registered with AD FS. For additional information, see the Microsoft MDSN article Developing Modern Applications using OAuth and Active Directory Federation Services⁸⁴.