GotSpeechGuy

I have been testing out the Microsoft Lync Server 2010 Multitenant Pack for Partner Hosting (that’s a long name) and comparing it to how things are done in  Lync Server 2010. One of the things I need to do is to add domains to the list of domains that a tenant can federate with. That turned out to be a little harder than I thought it would be.

The documentation is somewhat vague on how to do this but you normally see something like this:

$t = Get-CsTenant | Where-Object {$_.DisplayName –eq “Tenant1″}
Get-CsTenantFederationConfiguration –Tenant $t.TenantId
$d1 = New-CsEdgeDomainPattern -Domain “fabrikam.com”
$d2 = New-CsEdgeDomainPattern -Domain “contoso.com”
$a = New-CsEdgeAllowList -AllowedDomain @{replace=$d1,$d2}
Set-CsTenantFederationConfiguration –Tenant $t.TenantId -AllowedDomains $a

I tried that and it worked but it is somewhat limiting and confusing. First off the code above will set things up so that the only domains in Tenant1’s allow list will be “fabrikam.com” and “contoso.com”. That may be okay in some cases but what about the domains that were already in the allowed list for Tenant1? We just replaced them with our two new domains. And to make matters worse if you try to look at the federation configuration for Tenant1 using  Get-CsTenantFederationConfiguration you get something like this:

Identity                                  : Global
AllowedDomains                : Microsoft.Rtc.Management.WritableConfig.Settings.Edge.AllowList
BlockedDomains                : {}
AllowFederatedUsers      : True
AllowPublicUsers             : True
SharedSipAddressSpace : False

Where are our new domains? What the heck is a Microsoft.Rtc.Management.WritableConfig.Settings.Edge.AllowList  and how do I see the allowed domains?

How to use Set-CsTenantFederationConfiguration

It’s not obvious since there is no documentation (that I have found) and the Get-Help cmdlet doesn’t give me anything other than a parameter list. It turns out that it is fairly easy to do; just store the results to a variable then you can look at the AllowedDomains like this:

$tenant = Get-CsTenant | Where-Object {$_.Name –eq “$OU”}
$x = Get-CsTenantFederationConfiguration –Tenant $tenant.TenantId
$x.AllowedDomains

This will give you the following:

AllowedDomain : {Domain=fabrkam.com, Domain=contoso.com}

So we can now see our domains in the allowed list but what about the overwriting of the allowed list contents. Somehow we need to make sure we simply append the new domains and not replace existing domains in the allowed list. Its not hard but also not readily apparent how you go about this.

The Code

I wrote the following function to add a domain to the list and perserve the existing domains in the allowed list.  After getting the configuration we check to see if the domain we are adding is already in the list. If it is not in the list we add otherwise we throw an error. In order to add a domain (i.e. “GotSpeechGuy.com”) we first have to prepare the domain name (which is just a string) by using New-CsEdgeDomainPattern. Then we take advantage of the fact that AllowedDomain has an Add() method. After we do that we have a list that contains all the original domains and the new one we are adding so we simply call Set-CsTenantFederationConfiguration passing in the AllowedDomains. That is all there is to it and when we put it all together it looks like this:

function Set-AllowedDomain (
[Parameter(Mandatory = $true)][string]$OU,
[Parameter(Mandatory = $false)][array]$domainName
) 
{
    $tenant = Get-CsTenant | Where-Object {$_.Name –eq "$OU"}
    $x = Get-CsTenantFederationConfiguration –Tenant $tenant.TenantId
    $domain = $x.AllowedDomains.AllowedDomain | ?{$_.Domain -eq $domainName}
    if($domain -eq $null)
    {
        $d1 = New-CsEdgeDomainPattern -Domain "$domainName"
        $x.AllowedDomains.AllowedDomain.Add($d1)
        Set-CsTenantFederationConfiguration -Tenant $tenant.tenantID  -AllowedDomains $x.AllowedDomains
    }
    else
        {
            #Write-Host "ERROR: $domainName already in allowed list for $container"
            Throw (new-object Exception("ERROR: $domainName already in allowed list for $OU"))
        }
}

I hope this helps you and if you have any questions feel free to ping me.