Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have one server with ADFS-2.0 and a few websites on it. One of the websites is Dynamics CRM which listens on a specific IP address on port 443.

Dynamics CRM provides a metadata file for configuration purposes which could be used to configure a relaying party trust with ADFS. It is accessible with the URL

https://auth.contoso.com/FederationMetadata/2007-06/federationmetadata.xml

The problem is that ADFS-2.0 installs a service which registers following urlacl

https://+:443/FederationMetadata/2007-06/

This means the result of accessing the URL https://auth.contoso.com/FederationMetadata/2007-06/federationmetadata.xml is the metadata file of ADFS, not the one of Dynamics CRM.

I've tried to delete the default urlacl and added (one of them at a time)

https://192.168.1.2:443/FederationMetadata/2007-06/ https://adfs.mydomain.com:443/FederationMetadata/2007-06/

but neither of them worked. Instead the ADFS-service failed to startup complete.

Is there any way to bind this service to a IP address? At the moment I see only two alternatives

  1. Bind the service to a non standard port. This leads to problems because this means that also the ADFS website has to use a non-standard HTTPS-port.

  2. Install ADFS-2.0 on a different server (this is my favorite alternative - however it is not possible in every situation...)

share|improve this question

2 Answers 2

I'm making the assumption that Dynamics has its own website and does not use the default website. This may be totally incorrect.

Either way, if they are separate sites why don't you simply setup HTTPS Host Headers and ensure the default site and the dynamics site are both specifically assigned or bound to a certain host header or IP. You can always assign multiple IPs to the same NIC on the machine.

IIS SSL Host Header Command:

appcmd set site /site.name:"Name of Website in IIS" /+bindings.[protocol='https',bindingInformation='*:443:Host Header']
share|improve this answer
    
Because the Windows Service of AD FS 2.0 listens on all IP addresses. You are correct with your assumption. We have configured the binding for the website, but the service catches all request for this specific url –  ccellar Oct 2 '12 at 14:59
    
As I recall, if you are running a FS-S box and even an FS-P they both rely on IIS to catch the requests, the service is just a local intermediary that the IIS process then communicates with, this allows for integrated logon and a web form based logon in the case of the proxy server. Is that not what you are seeing? If so you just need to update the IP bindings for the default website from * to whatever IP you want it to use. –  Brent Pabst Oct 2 '12 at 15:31

I had the exact same configuration and was also looking for similar resolution. After a lot of searching I found this which explains workaround for starting ADFS on port different than 443. Unfortunately I was unable to successfully implement it, but I am not sure whether the problem was my specific configuration or the workaround in general.

Also I did not try playing with the urlacl - it seems like the problem could be right there. Use netsh http show urlacl to see the three urls that are added by ADFS.

So try it if you have the chance.

At the end I settled for the second option - installing ADFS on different machine which is basically MS proffered solution.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.