Host DKE on IIS, using an on-premises server

by | Oct 23, 2020 | Technology | 0 comments

This article is contributed. See the original author and article here.

Double Key Encryption (DKE) is a new feature, which enables customers to protect their most confidential content using a key they control, thereby allowing them to comply with regulatory requirements. DKE ensures that Microsoft cannot access their data under any circumstances.


The quickest way to get the DKE reference implementation running is by publishing it to Azure – detailed steps can be found in our documentation . However, many of our customers prefer to test and run DKE on-premises – here we describe the necessary steps to implement this option.


For this post, we assume the server will be reachable under the following URL:


https://aip-dke4.contoso-o365.net


Preparation


Whether the DKE service is published on Azure or on IIS, the following preparation steps from our documentation are required:



  1. Install software prerequisites for the DKE service

  2. Clone the Double Key Encryption GitHub repository

  3. Modify application settings

  4. Generate test keys

  5. Build the project



Provision machine and build IIS


By going through the following steps, the virtual machine is provisioned and IIS is installed:



  1. Provision VM with Windows Server 2019 Datacenter.

  2. Make sure the VM has outbound Internet Connectivity (among other, it needs to reach the following URL: <https://login.microsoftonline.com/common/v2.0>), for an exhaustive list of URLs and IP addresses, please consult box 56 on our documentation:URLs and IP addresses that need to be reachableURLs and IP addresses that need to be reachable

  3. Join the server to a domain, in case membership of a local AD group should be the criteria for authorizing access to the DKE service.

  4. Install a suitable Web server certificate to the machine store. The certificate needs to match the URL, under which the service can be reached.
    Certificate used for IISCertificate used for IIS

  5. Install IIS with with default role features – selecting «Next» on each page of the wizard.
    screenshot3.jpg
    screenshot4.jpg

  6. Download and install the .NET 3.1.9 hosting bundle. The bundle is available here.


Build and publish code to IIS



  1. Switch to the machine with Visual Studio Code installed, which was used for steps 1 to 5.

  2. Open an administrative command line and switch to the directory «DoubleKeyEncryptionServicesrccustomer-key-store»

  3. Run the following command:
    dotnet publish –configuration Release

  4. Transfer the following directory to the folder c: of the IIS machine – this will result in a new folder c:publish on the IIS machine:
    «DoubleKeyEncryptionServicesrccustomer-key-storebinReleasenetcoreapp3.1publish»

  5. On IIS, create a new web site «DKE» with https binding, port 443 and using host name “aip-dke4.contoso-o365.net”:
    IIS site configurationIIS site configuration

  6. Make sure the value for «JwtAudience» matches the selected URL for the IIS Server:
    screenshot6.jpg


Finish DKE implementation


The following steps are needed to complete the DKE implementation (refer again to our documentation)


7. Validate your deployment


8. Register your key store


9. Create sensitivity labels using DKE


10. Enable DKE in your client


11. Migrate protected files from HYOK labels to DKE labels


Conclusion


By publishing the DKE service on an on-premises server with IIS, customers maintain full control over the key used for protecting their most sensitive content.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Submit a Comment