Application Migration: LDAP and Kerberos to Modern Authentication¶

# Method 1: AD FS relying party trusts
# Run on AD FS server:
Get-AdfsRelyingPartyTrust |
    Select-Object Name, Identifier, IssuanceTransformRules,
    MonitoringEnabled, Enabled, TokenLifetime |
    Export-Csv ".\adfs-relying-parties.csv" -NoTypeInformation

# Method 2: LDAP query logging
# Enable LDAP diagnostics on domain controllers:
# Registry: HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics
# Set "16 LDAP Interface Events" to 2 (Basic)
# Analyze Event ID 2889 (unsigned LDAP binds) and 1644 (LDAP queries)

# Method 3: Kerberos service ticket analysis
# Analyze Security Event 4769 (Kerberos Service Ticket Operations)
Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id = 4769
    StartTime = (Get-Date).AddDays(-30)
} | ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
        ServiceName = $xml.Event.EventData.Data[0].'#text'
        ClientAddress = $xml.Event.EventData.Data[6].'#text'
        TicketType = $xml.Event.EventData.Data[4].'#text'
    }
} | Group-Object ServiceName | Sort-Object Count -Descending |
    Select-Object Count, Name | Export-Csv ".\kerberos-service-tickets.csv"

# Generate AD FS application usage report
# Identifies which relying parties are actively used

# On AD FS server (requires AD FS 2019+):
$rpUsage = Get-AdfsRelyingPartyTrust | ForEach-Object {
    $rp = $_
    $events = Get-WinEvent -FilterHashtable @{
        LogName = 'AD FS/Admin'
        Id = 299  # Token issued
        StartTime = (Get-Date).AddDays(-90)
    } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match $rp.Identifier }

    [PSCustomObject]@{
        Name = $rp.Name
        Identifier = $rp.Identifier[0]
        Protocol = if ($rp.WSFedEndpoint) { "WS-Fed" } else { "SAML" }
        TokensIssued90Days = $events.Count
        LastUsed = ($events | Sort-Object TimeCreated -Descending | Select-Object -First 1).TimeCreated
    }
}

$rpUsage | Sort-Object TokensIssued90Days -Descending |
    Export-Csv ".\adfs-app-usage.csv" -NoTypeInformation

# Configure SAML claims for enterprise app
$appObjectId = "enterprise-app-object-id"

# Add custom claim mapping policy
$claimPolicy = @{
    definition = @(
        '{"ClaimsMappingPolicy":{"Version":1,"IncludeBasicClaimSet":"true","ClaimsSchema":[{"Source":"user","ID":"employeeid","SamlClaimType":"http://schemas.contoso.com/claims/employeeid"},{"Source":"user","ID":"department","SamlClaimType":"http://schemas.contoso.com/claims/department"}]}}'
    )
    displayName = "Custom Claims - Contoso App"
    isOrganizationDefault = $false
}

$policy = New-MgPolicyClaimMappingPolicy -BodyParameter $claimPolicy
# Assign policy to service principal

# Step 1: Install Application Proxy connector on an on-premises server
# Download from Entra admin center > Applications > Application Proxy
# Run installer:
.\AADApplicationProxyConnectorInstaller.exe /quiet

# Step 2: Configure the enterprise application
# Via Microsoft Graph API:
$appProxy = @{
    displayName = "Legacy HR Application"
    web = @{
        redirectUris = @("https://hr.contoso.com/")
    }
}
$app = New-MgApplication -BodyParameter $appProxy

# Step 3: Configure Application Proxy settings
# Entra admin center > Enterprise Apps > [App] > Application Proxy
# Internal URL: http://hr-internal.contoso.local:8080/
# External URL: https://hr.contoso.com/ (auto-generated or custom domain)
# Pre-authentication: Azure Active Directory
# Connector Group: Default (or custom group)

# Configure KCD for the Application Proxy connector
# The connector machine account needs delegation rights

# Step 1: Set SPN on the application service account
setspn -s HTTP/hr-internal.contoso.local svc-hr-app

# Step 2: Configure KCD on the connector computer account
# Active Directory Users and Computers > Connector Computer > Delegation tab
# "Trust this computer for delegation to specified services only"
# "Use any authentication protocol"
# Add: HTTP/hr-internal.contoso.local

# Step 3: Configure SSO in the enterprise app
# Entra admin center > Enterprise Apps > [App] > Single sign-on
# Mode: Windows Integrated Authentication
# Internal application SPN: HTTP/hr-internal.contoso.local
# Delegated Login Identity: User principal name

# Configure Kerberos cloud trust
# Step 1: Create the Entra Kerberos server object in AD
Install-Module -Name AzureADHybridAuthenticationManagement -Force

$domain = "contoso.com"
$cloudCred = Get-Credential -Message "Entra ID Global Admin"
$onPremCred = Get-Credential -Message "AD Domain Admin"

Set-AzureADKerberosServer -Domain $domain `
    -CloudCredential $cloudCred `
    -DomainCredential $onPremCred

# Step 2: Verify the Kerberos server object
Get-AzureADKerberosServer -Domain $domain -CloudCredential $cloudCred `
    -DomainCredential $onPremCred