1

I have created a AWS Managed Microsoft AD, and I have a Windows Server 2019 EC2 instance where I am trying to enable AD FS. I have joined the EC2 instance to the domain, installed AD tools, and am able to perform basic AD tasks using the default AD Admin user. So far so good.

However when I try to configure AD FS, I get stuck with this error

"The credential provided is not a domain administrator. Provide a credential that is a member of the Domain Admins group and try again."

enter image description here


Taking a look at the AWS docs, I found this.

https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_getting_started_admin_account.html

To perform operational management of your directory, AWS has exclusive control of accounts with Enterprise Administrator and Domain Administrator privileges. This includes exclusive control of the AD administrator account.

So..... how could I possibly enable AD FS unless I had access to the AD administrator account?

secondbreakfast
  • 4,194
  • 5
  • 47
  • 101

2 Answers2

1

You can't.

When you install ADFS it searches for available DC and writes a number of entries to AD.

To do this, it needs domain admin.

You don't need domain admin. to run ADFS. It can use a service account.

rbrayb
  • 46,440
  • 34
  • 114
  • 174
  • Thanks. Im confused that you say I don't need domain admin though. The error I am getting says I do. Complete noob at this btw, in case you couldn't tell. – secondbreakfast Nov 03 '20 at 14:31
  • You need domain admin. to install ADFS, You don't need domain admin. to run the ADFS service. – rbrayb Nov 03 '20 at 18:02
1

It was a truly sad limitation of AWS Directory Service until, surprisingly, AWS themselves suggested a crafty way to install AD FS on AWS Managed Directory Service in one of their blog posts: https://aws.amazon.com/blogs/security/how-to-enable-your-users-to-access-office-365-with-aws-microsoft-active-directory-credentials/

What the blog post is saying is that you can create a custom container for AD FS and then make the AD FS service use it (instead of the default container, which is unavailable as you do not have full admin rights to the whole domain).

I will not provide the recipe here as it is well described in the article referenced above.

kurianoff
  • 21
  • 5