1. In the Azure Management Portal, choose the Active Directory button.

2. Choose the New button, point to Access Control, and then choose Quick Create.

3. Fill in the fields as described in the following table.

   Field	Description
   Namespace	Enter a name for the namespace. The name can be any text. For example, you can enter the name of your company for the namespace name. A green checkmark appears if the namespace is available. The value that you specify because a prefix for the fully qualified namespace, such as mynamespace.accesscontrol.windows.net.
   Region	Choose the Windows Azure region that you want to host your namespace in. Choose the region that most closely matches your country/region. For example, if you and your customers are located in Denmark, choose North Europe, unless another region suits your needs better.
   Subscription	Choose your Windows Azure subscription.

4. Choose Create.

After the status of your namespace becomes Active, you can continue with configuring the namespace.

1. Select your namespace. In the menu at the bottom of the page, choose Manage.

   Note
   If this button is not available, you may want to obtain Portal Administrator permission for the namespace. Ask the Service Administrator for the Azure subscription to grant you this permission. Co-administrator permission is sufficient for creating a namespace, but not for managing ACS.

2. In the left pane of the Access Control Service section of the Azure Management portal, choose Identity Providers.

   An identity provider is an organization that provides authentication services that you can use as your ACS authentication mechanism. There are five possible identity providers. Windows Live ID is the default identity provider. Two of the other options require no configuration: Google and Yahoo!. The final two require additional configuration: Facebook and WS-Federation. WS-Federation lets users authenticate by logging on to their corporate account, which is managed by Active Directory. For more information about how to configure a WS-Federation identity provider, see How to configure AD FS 2.0 as an Identity Provider in the MSDN Library.

3. Select the identity providers that you want to make available to the users. You can choose as few as one, such as just Windows Live ID, or as many as all five identity providers.

   Next, you specify relying party applications. Relying party applications are the websites, applications, and services for which you want to use ACS to implement Shared Services authentication. In this case, the relying party applications are Microsoft Dynamics NAV clients.

1. In the left pane of the Access Control Service section of the Azure Management portal, choose Relying Party Applications, and then choose Add.

2. In the Add Relying Party Application page, fill in the fields as described in the following table.

   Field	Description
   Name	Specify a name for the application. A typical value would be the name of the organization for which the deployment was created.
   Mode	Choose Enter settings manually.
   Realm	Enter the DNS name of the Microsoft Dynamics NAV Server instance, such as https://MyCompany.com or https://localhost. The DNS name must be the same that is specified in the Server parameter in the clientUserSettings.config file for Microsoft Dynamics NAV Windows client client and the web.config file for Microsoft Dynamics NAV Web client clients.
   Return URL	Enter the fully qualified URL for the Microsoft Dynamics NAV Web Server components, such as https://MyCompany.com or https://MyServer/WebClient. The URL is case-sensitive. If you do not deploy the Microsoft Dynamics NAV Web Server components, you can specify any address since the Microsoft Dynamics NAV Windows client does not use this setting.
   Token format	Select SWT. Other token types are not supported in this version of Microsoft Dynamics NAV. This adds a Token Signing Settings section to the page.

3. In the Token Signing Settings section, in the Token signing key field, choose the Generate button.

4. Specify an effective date and an expiration date for the key.

   Security Note
   To help secure your deployment, schedule a regeneration of this key regularly.

5. Copy the string of characters that automatically populate the field.

   You will use this string to update the TokenSigningKey in the server configuration.

6. Choose the Save button to save your relying party application configuration.

   Next, you add a rule group. Rule groups define how claims are passed from identity providers to your relying party applications.

1. In the left pane of the Access Control Service portal, choose Rule groups.

2. Choose the default rule group for the relying party applications that you just created.

3. In the Edit Rule Group page, choose Generate. In the Generate Rules page, choose the relevant identity provider, and then choose the Generate button.

4. Choose the Save button.

   The final step in the Access Control configuration is to add a Shared Services login page to your relying party application. There is where your user can present credentials for the configured identity provider.

1. In the left pane of the Access Control Service portal, choose Application Integration.

2. On the Application Integration page, choose Login Pages.

3. Choose your relying party application.

4. Under Option 1: Link to an ACS-hosted login page, copy the URI from the first text box to Notepad.

5. In Notepad, replace any instances of the ampersand character (&) with %26.

   You will use this URI in the server configuration for ACS.

• During the configuration of your deployment for ACS, you have saved two values:

  • The string of characters from the Token signing key field in the Add Relying Party Application page.
    
  • The URI for your relying party application from the Application Integration section.
    

  You will need these values for the next stage in the ACS configuration process, which is configuring your Microsoft Dynamics NAV components for ACS. For more information, see Configure Microsoft Dynamics NAV Components for ACS.

Tasks

Concepts