Back to ADFS Certificates

Hi there!

ADFS certificates? Yes! They come back to me as little nightmare xD, but in the end, this time was pretty simple to solve it.

The problem begun with a client call that I planned to visit the same day (for other reasons), and he was in panic because the certificates associated with the CRM and ADFS needs to be updated, since the day after will expire.

At the beginning I though, “I don’t have any idea about CRM and how to update the certificates”, but having a technical background I decided to tell him that after the meeting we could have a look to the CRM and the ADFS farm to see what was happening.

Once I finished the meeting with him, I meet with the person in charge of updating the certificates, he explained me how he updated the certificates in the CRM, but he still has a problem with the certificates in the ADFS farm, for me it was like light in the darkness, I don’t need to deal with the CRM, only with ADFS!! 1 point!

Looking to the ADFS farm, the first thing that I realized it was that he updated the decrypting and signing certificates, but the service communications shows a message saying that “It is not possible to find the certificate”. Weird… the client told me that he imports the certificates in the personal Store, so the certificates exist.

If you tried to associate a new certificate with the button “Set service communications certificate”, it fires an error in the ADFS console, but it doesn’t write anything in the event viewer. I started to check in the IIS (it was a 2.0 ADFS) the certificates, I realized that in the binding, the certificate was not associated, I associated it, okay.

Come back to the ADFS console, and try to re-associate the certificate, no luck.

I was pretty sure, that the problem was with the certificate associated, so I starts to look into my PowerShells, one PowerShell to reassociate the CS certificate by scripting, since the interface does not work. But by the time, I asked to the client if he still conserves the old certificate that he delete it, he say yes, and I asked him to reimport it again to the store.

Once the certificate was imported again, I refresh the ADFS farm… and bang!! The CS shows the old certificate, great, then my following action was to try to set the set service communication certificate, and bang! It shows the dialog where is it possible to see the old certificate and the new one, I selected the new one and finally I restarted the ADFS service.

I tested with the CRM, and it was possible to see that it connects with the new certificate 😊. So… what I learned from this experience? Never delete a certificate without first renewing it and test that everything is okay.

By the way, I found the PS to set the CS certificate, but it was not necessary to execute it:

Set-AdfsSslCertificate –Thumbprint <ThumbprintCertificate>

Set-WebApplicationProxySslCertificate –Thumbprint <ThumbprintCertificate>

Advertisements

How to connect to Windows Internal Database (WID) with SQL Server Management Studio

The Windows Internal Database (WID) is used by the following Windows server components:

  • Windows Server Update Services (WSUS)
  • Active Directory Federation Services (AD FS)
  • Active Directory Rights Management Services (AD RMS)
  • Windows System Resource Manager (WSRM)

For Windows Server 2008 R2 and Windows Server 2008, you can use the following named pipes (NP) string:

\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query

On Windows Server 2012, Windows Server 2012 R2 and Windows Server 2016 you must use a different np connection string:

\\.\pipe\MICROSOFT##WID\tsql\query

ADFS 4.0 idpinitiatedsignon Error

Hi all,

The other day I was creating an ADFS lab in order to test some features and configurations, as you will probably know, a quick way to test an ADFS deployment is to access the idpinitiatedsignon sign page.

After I deployed my ADFS farm, I tried to access and I received the following error message: “The resource you are trying to access is not available. Contact your administrator for more information.”

At the beginning it was annoying, because I was thinking that I did someone incorrectly, so I spend some time thinking about what I did wrong, I checked the event log and I saw the following:

Description:
Encountered error during federation passive request.

Additional Data

Protocol Name:
Relying Party:
Exception details:
Microsoft.IdentityServer.Web.IdPInitiatedSignonPageDisabledException: MSIS7012: An error occurred while processing the request. Contact your administrator for details.
at Microsoft.IdentityServer.Web.Protocols.Saml.IdpInitiatedSignOnRequestSerializer.ReadMessage(WrappedHttpListenerRequest httpRequest)
at Microsoft.IdentityServer.Web.Protocols.Saml.HttpSamlMessageFactory.CreateMessage(WrappedHttpListenerRequest httpRequest)
at Microsoft.IdentityServer.Web.Protocols.Saml.SamlContextFactory.CreateProtocolContextFromRequest(WrappedHttpListenerRequest request, ProtocolContext& protocolContext)
at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.CreateProtocolContext(WrappedHttpListenerRequest request)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.GetProtocolHandler(WrappedHttpListenerRequest request, ProtocolContext& protocolContext, PassiveProtocolHandler& protocolHandler)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)

So, indeed what it is saying is that the idpinitiatedsignon property is disabled. So, to check if it is this, you can execute the following PS command in the ADFS farm:

Get-AdfsProperties | fl *idpinitiatedsignon*

adfs.png

As you can see in the picture, it was disabled, so in order to solve this problem, just run the following command:

Set-AdfsProperties -EnableIdpInitiatedSignonPage $true

After that, all my problems were solved 😊

ADFS: Configure your password change

Users are always allowed or forced to change their passwords, and sometimes this actions increment the amount of work to IT. However, in ADFS 3.0 include a feature that enable a self-service portal password change available for your end-users.

So this post tries to follow the steps to configure it:

  • First, enable the Password Change Portal:Open your AD FS Management tool on the primary server, navigate to the EndPoints under Services\Endpoints. At the bottom you will see the /ADFS/portal/updatepassword/ endpoint, right click it and choose enable. Right click again and choose enable on proxy.
  • Test change password portal: browse to https://sts.domain.com/adfs/portal/updatepassword you will similar to the adfs login page where you can update your password
  • Enable password expiry notification: You can configure Active Directory Federation Services (AD FS) to send password expiry claims to the relying party trusts (applications) that are protected by ADFS. To do this it is necessary to configure a Claim Rule:

c1:[Type == “http://schemas.microsoft.com/ws/2012/01/passwordexpirationtime”%5D => issue(store = “_PasswordExpiryStore”, types = (“http://schemas.microsoft.com/ws/2012/01/passwordexpirationtime&#8221;, “http://schemas.microsoft.com/ws/2012/01/passwordexpirationdays&#8221;, “http://schemas.microsoft.com/ws/2012/01/passwordchangeurl&#8221;), query = “{0};”, param = c1.Value);

  • Finally: you can tweak your ADFS login page to show a link to the change password portal

That’s all!

Ref: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-to-send-password-expiry-claims

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/ad-fs-user-sign-in-customization

 

Enable ADFS automatic certificate rollover

Hi!

After the summer holidays, I realised that the token decripting and token signing certificates from the ADFS, were about to expire. I tried to execute the following command to update immediately the certificates:

Update-ADFSCertificate -Urgent

but I received the following message error:

adfscert.PNG

To disable the ADFS automatic certificate rollover, use the below Powershell script command, this will help if you want to add a token signing certificate when the automatic certificate rollover is enabled.

Set-ADFSProperties -Autocertificaterollover $true

After doing that, I was able to update the ADFS certificates from the certificate store.

Hope it helps!

Backup rules in ADFS

If you need to back up the rules of claim provider trusts and relying-party trusts in ADFS to store version control or to migrate rules to a new federation server, this is your post.

And here is the code I used:

# Guidance for this was found here: http://social.technet.microsoft.com/wiki/contents/articles/4869.ad-fs-2-0-how-to-migrate-claim-rules-between-trusts.aspx
#
#  If you want the files saved somewhere other than C:Temp, you need to change the "$RulePath" lines below.

Import-Module ADFS

# Export the Acceptance Transform Rules for each Claim Provider Trust (except the AD one)
$claimTrusts = Get-AdfsClaimsProviderTrust | ?{$_.Name -ne "Active Directory"}
foreach ($CT in $claimTrusts) {
    $RulePath = "C:Temp" + $CT.Name.Replace(" ","") + "-AcceptanceRules.txt"
    (Get-AdfsClaimsProviderTrust -Name $CT.Name).AcceptanceTransformRules | Out-File $RulePath
    $RulePath = $null
    }

# Export all three types of rules for each Relying-Party Trust
$RPTrusts = Get-AdfsRelyingPartyTrust
foreach ($RP in $RPTrusts) {
    $RulePath = "C:Temp" + $RP.Name.Replace(" ","") + "-IssuanceTransformRules.txt"
    (Get-AdfsRelyingPartyTrust -Name $RP.Name).IssuanceTransformRules | Out-File $RulePath
    $RulePath = "C:Temp" + $RP.Name.Replace(" ","") + "-IssuanceAuthRules.txt"
    (Get-AdfsRelyingPartyTrust -Name $RP.Name).IssuanceAuthorizationRules | Out-File $RulePath
    $RulePath = "C:Temp" + $RP.Name.Replace(" ","") + "-DelegationAuthRules.txt"
    (Get-AdfsRelyingPartyTrust -Name $RP.Name).DelegationAuthorizationRules | Out-File $RulePath
    }

Hope it helps!