Hot answers tagged

114

For a non-Microsoft person, what is ADFS? ADFS is Microsoft's solution for Single Sign On and web based authentication. It is used primarily to provide a single set of credentials that can access a variety of sites not necessarily hosted within the same domain. How does it differ to things like LDAP? LDAP: Communicates using TCP/UDP on port 389 (or ...


87

I've managed large numbers of workstations without AD. I had power tools (Altiris Deployment Solution), but it still hurt in certain situations: Security auditor comes in and says that our default workstation password policy isn't good enough. In order to change password complexity and expiration, etc., on 5,000 machines, we had to write a (nontrivial) ...


20

This can be done by adding a so-called Issuance Authorization Rule. Step-by-step: Open AD FS Management Center Expand Trust Relationsships Select Relying Party Trusts Right click the required trust Click Edit Claim Rules Goto the Issuance Authorization Rules tab Delete the default Permit Access To All Users rule Click Add Rule Select Permit or Deny Users ...


13

AD and GPO will still handle management of workstations. Without it, you're paying for a 3rd party application or really really really trusting your users. If you're doing something like strictly BYOD, or distributing only stateless VMs for working, then this doesn't apply as much.


10

First run CMD as Admin netsh http show sslcert look for certificates that are dead or the below example Get rid of them by using: netsh http delete sslcert ipport=0.0.0.0:443 then you should be good.


10

I've done this. In our model, we have three sets of users: Internal users authenticating via Active Directory (Kerberos or NTLM) against the local AD FS instance. In this set, the AD FS server runs as the IdP. External users authenticating via Active Directory (Kerberos or NTLM) against their own AD FS instance and domain. In this set, the AD FS Server ...


9

Goto bindings of your IIS website, check if you have a valid cert selected for 443 port. If you already have, check validity of that cert if already exhausted. Try changing cert to see if its corrupted.


8

The Cloud is just another ISP While exciting, any Cloud is just another outsourcing provider - a company trying to offer flexibility for your infrastructure and operations, often at lowered cost, and (hopefully) better reliability. Sure, the Cloud is targeted at simplifying common sought out service objectives like scalability, reliability and performance - ...


8

The central point of this issue depends on what you see AD as doing for you. If it's only being used as the central store for SSO credentials that are only used to authenticate to cloud apps then of course it can be replaced with another central store. But AD can do a lot more than that: Software deployment. OS Deployment. Printer Management. User ...


8

Active Directory Federation Services (ADFS) is primarily concerned with authentication. It is not a metadirectory and can't be used to return generalized information from Active Directory. Accessing the Active Directory through LDAP is probably the direction you want to go, as it allows you to both query the attributes of user accounts (and other objects). ...


8

No ADFS is an option, particularly if you plan on using other, non Microsoft server apps along with Azure AD as the authentication directory. It is not required.


6

I didn't know the answer to your question off the top of my head, since after managing 5000+ user workstations and 30 servers without AD I kind of feel like any network larger than two workstations needs AD, ;) so I went and looked. The ADFS requirements at Technet say: Domain Requirements All AD FS servers must be a joined to an AD DS domain. ...


6

On Windows Server 2016 you need to explicitly grant clients permission to a resource, even when the access policy is set to "Permit everyone". Try this command: Grant-AdfsApplicationPermission -ClientRoleIdentifier "clientName" -ServerRoleIdentifier "https://service.url"


6

Just in case anyone else is looking for it you can set it with the Set-AdfsResponseHeaders powershell command Set-AdfsResponseHeaders -EnableCORS $true Set-AdfsResponseHeaders -CORSTrustedOrigins http://localhost, https://contoso.com Get-AdfsProperties | select EnableCORS, CORSTrustedOrigins


5

Could you? Yes. Would you want to? I don't think so. All of the hosted solutions you mentioned support AD Federation, and since you want SSO everywhere the only universal way of accomplishing that is going to be AD. And products like LastPass are a password vault, not SSO.


5

Finally found the solution after a week of google, tries, server rebuilds etc! (This guru answered it in a blink and no one knew it! https://www.experts-exchange.com/questions/28994182/ADFS-Passive-Request-There-are-no-registered-protocol-handlers.html) The IdP-Initiated SSO page (https://fs.t1.testdom/adfs/ls/idpinitiatedsignon.aspx). Note that if you are ...


5

It seems that chaining relying parties is indeed possible. This guy has written a series of posts about it, here's one. You can use ADFS as the "hub" for your app to auth against, and it will chain the request back to whichever service the user's identity actually lives in. https://cloudidentityblog.com/2013/06/17/why-use-aad-as-idp-via-ad-fs-rp/ I haven't ...


5

Yes, it can. Each of these external IDP is added as a claims provider in ADFS and on the IDP side, ADFS is added as a Relying Party. When you authenticate, ADFS will show a Home Realm Discovery screen that lists all the IDP. You then choose which one you want to use.


4

An ADFS rule is composed of a condition, the => token, a command (issue or add), and terminated with a semicolon. You cannot issue multiple literals per rule, but you can use powershell to make it easier to work with. Instead of going in the UI, and going through that wizard 5 times, you can use Set-AdfsRelyingPartyTrust to set all of the rules at once. ...


4

ADFS is a role that you can install using the server manager or the powershell cmdlet. No need to use external installer to add this feature to a Windows Server 2012. The correct powershel cmdlet is: Add-WindowsFeature ADFS-Federation Afaik you can't downgrade or choose which version to install as it will install the latest version automatically which in ...


4

There are several certificates in a SAML2 and WS-federation trusts. I will ignore here the TLS certificate of the https url of the servers (ADFS calls it the communication certificate). Each party can have a signing certificate. The messages that the party sends are signed with the private key of that certificate. SAML2 parties often sign both requests and ...


4

Have you tried: Create a new rule, choose “Send LDAP Attributes as Claims” Choose Active Directory as the Attribute Store, and choose the LDAP Attribute “Token-Groups – Unqualified Names” and the claim type as “Group” This should send all groups. Note that your ADFS admin should NOT be allowing you to do a query like this, especially in large ...


4

Figured it out. Pretty straight forward actually. So heres the deal: You must first disable your global settings or at least those affecting how they set it. Make sure you still select your MFA provider (such as RSA or Cert), but don't fill anything else in. Then go to Run As Administrator PowerShell. Enter this command: Set-...


4

The GMSA must be created with a host SPN (not http) based on the FederationServiceName parameter. So if you use adfs.ad.redacted.com then the SPN will be host/adfs.ad.redacted.com. You should not be using CNAME entries to point adfs.ad.redacted.com to individual servers. That's going to cause Kerberos authentication issues as explained in https://blogs....


3

There is a configuration switch named IssueOAuthRefreshTokensTo on the ADFS relying party object which controls what type devices refresh tokens are emitted to. By default this value is set to "NoDevice" which implies that ADFS will not release refresh tokens. Possible values are NoDevice = never issue refresh tokens AllDevices = always issue refresh ...


3

Aside from some really good answers, I'd like to reverse the question: what's the point in not having Active Directory if you are running a Microsoft shop? You can get around to use and manage Microsoft products without AD, but they are just designed to work with it, and native AD integration will always be better than any workaround you can throw in. Less ...


3

The objectGuid LDAP attribute can be sent as the value of any claim by using "Send LDAP Attributes as Claims Rule" and specifying objectGuid as the source attribute. ADFS has no specific knowledge of LDAP attributes, and if you were to extend your LDAP schema, you could use those just as easily as any other. The particular claim you must transform it to is ...


3

Assuming this is for O365 or Intune - DirSync is a required component. DirSync will allow same sign-on, meaning the passwords are the same in both environments. Adding ADFS will allow single sign-on, meaning users will seamlessly authenticate without being prompted for credentials. DirSync is a foundational component for both same sign-on and single sign-on. ...


3

It depends on your needs, if you need to provide SSO to your environment you should deploy ADFS. On the other side if you only want your users use their AD password to log on Office365 you should user DirSync. In the fomer scenario the authorization is performed by your AD environment and trusted by Office 365. In the DirSync scenario is actually Office365 ...


3

There are three different downloads on that page, did you select the one for 2008 R2 or 2008 SP2? They are different products.


Only top voted, non community-wiki answers of a minimum length are eligible