Skip to main content
18 votes

An error occurred while using SSL configuration for endpoint 0.0.0.0:443

First run CMD as Admin netsh http show sslcert look for certificates that are dead or the below example Get rid of them by using: netsh http delete sslcert ipport=0.0.0.0:443 then you should be ...
Mike Caldera's user avatar
10 votes
Accepted

Can ADFS connect to other SSO services?

I've done this. In our model, we have three sets of users: Internal users authenticating via Active Directory (Kerberos or NTLM) against the local AD FS instance. In this set, the AD FS server runs ...
Mitch's user avatar
  • 2,353
8 votes

Is ADFS a must-have, when you deploy hybrid exchange server?

No ADFS is an option, particularly if you plan on using other, non Microsoft server apps along with Azure AD as the authentication directory. It is not required.
Jim B's user avatar
  • 24.1k
7 votes

ADFS Error - MSIS9605: The client is not allowed to access the requested resource

On Windows Server 2016 you need to explicitly grant clients permission to a resource, even when the access policy is set to "Permit everyone". Try this command: Grant-AdfsApplicationPermission -...
Tu Dinh's user avatar
  • 171
6 votes
Accepted

Cannot set CORSEnabled and CORSTrustedOrigins properties on ADFS 2019

Just in case anyone else is looking for it you can set it with the Set-AdfsResponseHeaders powershell command Set-AdfsResponseHeaders -EnableCORS $true Set-AdfsResponseHeaders -CORSTrustedOrigins ...
Alan's user avatar
  • 76
5 votes
Accepted

ADFS Passive Request = "There are no registered protocol handlers"

Finally found the solution after a week of google, tries, server rebuilds etc! (This guru answered it in a blink and no one knew it! https://www.experts-exchange.com/questions/28994182/ADFS-Passive-...
Raheel Hasan's user avatar
5 votes

Can ADFS connect to other SSO services?

It seems that chaining relying parties is indeed possible. This guy has written a series of posts about it, here's one. You can use ADFS as the "hub" for your app to auth against, and it will chain ...
mfinni's user avatar
  • 36.3k
5 votes

Can ADFS connect to other SSO services?

Yes, it can. Each of these external IDP is added as a claims provider in ADFS and on the IDP side, ADFS is added as a Relying Party. When you authenticate, ADFS will show a Home Realm Discovery ...
rbrayb's user avatar
  • 1,128
4 votes
Accepted

Security error when adding a secondary ADFS Server

The GMSA must be created with a host SPN (not http) based on the FederationServiceName parameter. So if you use adfs.ad.redacted.com then the SPN will be host/adfs.ad.redacted.com. You should not be ...
maweeras's user avatar
  • 2,744
4 votes
Accepted

ADFS: Some Users Cannot Sign-In

The Windows Authorization Access Group did not have authority to read the tokenGroupsGlobalAndUniversal property on the accounts in question. Theses are the steps I took to fix the issue: Open Active ...
Jeremy's user avatar
  • 91
3 votes
Accepted

ADFS error after upgrading from ADFS 2.1 to 4.0

Looks like you are running into issue in https://blogs.technet.microsoft.com/pie/2016/10/23/adfs-2016-cannot-addupdate-relying-party-from-the-gui-from-metadata-files/
maweeras's user avatar
  • 2,744
3 votes
Accepted

Why do I get "InvalidNameIdPolicyException: MSIS7070" when authenticating via ADFS?

You need to add "Persistent name identifier" claim rules: Choose your Relying Party Trust and make a custom issuance transform rule to create unique user identifier claim. Then transform persistent ...
Bifeng Dong - MSFT's user avatar
3 votes

If a Windows shop moves "everything" to the cloud, does it still need Active Directory?

Aside from some really good answers, I'd like to reverse the question: what's the point in not having Active Directory if you are running a Microsoft shop? You can get around to use and manage ...
Massimo's user avatar
  • 71.5k
3 votes
Accepted

How to move ADFS to new servers?

If I recall correctly, ADFS on 2012R2 can only be installed in a farm, even with just 1 node (as opposed to a standalone mode available in previous versions). If thats the case, you can expand your ...
BHall's user avatar
  • 333
3 votes
Accepted

Office 365 ADFS authentication not working for child domains

The issue is very scarcely documented (a Technet blog post and some documentation for Azure AD), but it indeed exists, and it's caused by ADFS not behaving correctly in certain specific situations (...
Massimo's user avatar
  • 71.5k
3 votes
Accepted

Can we configure ADFS for IDP initiated SSO

See https://blogs.technet.microsoft.com/askds/2012/09/27/ad-fs-2-0-relaystate/ and referenced articles for details
maweeras's user avatar
  • 2,744
3 votes
Accepted

How do i install AD FS management tools on windows 10 pro to remotely manage my AD FS server

As of February 2017, there is no remote UI for AD FS per this User Voice issue. Normally, it would be included in something like RSAT. ADFS Management Console missing from RSAT The current ...
Ryan Bolger's user avatar
  • 16.9k
3 votes

Disable TLS 1.0 and 1.1 on WIndows 2012 R2 ADFS and WAP

This is at a lower layer than ADFS so nothing to do ADFS wise. Just FYI: I find https://www.ssllabs.com/ssltest/ useful which shows the current settings. Also download "IIS Crypto" and have a look ...
rbrayb's user avatar
  • 1,128
3 votes
Accepted

How to integrate Office 365 with Microsoft on-premise Multi-Factor Authentication?

Yes, as you are using ADFS for your Office 365 logins you just need to configure ADFS to use the MFA server. Office is effectively handing over the authentication process to your ADFS setup.
Sam Cogan's user avatar
  • 38.9k
3 votes
Accepted

setting up ADFS without SSL certificate

SSL certificates are required for ADFS. While I have not tried these routes, you can use self signed (not recommended,) certificate generated by your own window CA, or using Let's Encrypt(free). ...
SteamerJ's user avatar
  • 403
2 votes

Steps for troubleshooting Windows ADFS issue

This looks promising: http://social.technet.microsoft.com/wiki/contents/articles/3910.extending-the-error-diagnostics-of-adfs.aspx One really helpful aspect of ADFS is that there is a code-level ...
Greg Askew's user avatar
  • 37.1k
2 votes

Office 365 SSO with different internal and external domain names

You need to add your external domain (email domain) as an alternate UPN suffix for internal Active Directory users. To add UPN suffixes (from TechNet) Open Active Directory Domains and Trusts. To ...
Sam Erde's user avatar
  • 3,479
2 votes

Office 365 SSO with different internal and external domain names

When you sync with Office 365 your internal domain must be a routable address and this should be assigned to users UPN suffix. When you sync users you will then use the same logon as you would ...
Jesus Shelby's user avatar
  • 1,304
2 votes
Accepted

Sharepoint Online auto acceleration not working

The issue is that the domain that was required for the SignInAccelerationDomain wasn't the domain used as the UPN for office 365 but the full domain name of the Windows domain. So i had to enable in ...
Ronan Thibaudau's user avatar
2 votes

Use of SSL in ADFS

You've already got to know the root cause here: Root cause:This problem occurs because the certificate used employs newer cryptographic technology known as Cryptographic Next Generation (CNG). CNG ...
Bifeng Dong - MSFT's user avatar
2 votes

Purpose of "secure hash algorithm" option in ADFS relying party properties

Microsoft has already announced that they wouldn't be accepting SHA1 certificates after year 2016. So it's recommended that you use SHA2. However, there is possibility that some applications don't ...
Bifeng Dong - MSFT's user avatar
2 votes

ADFS error after upgrading from ADFS 2.1 to 4.0

I had this issue as well until I discovered the TLS settings between the two systems were in conflict. The server hosting the metadata was set to use only TLS 1.2 while the ADFS server running on ...
Michael Hlavinka's user avatar
2 votes

Configuring Google Chrome to Connect to AD Configured with Kerberos and Using ADFS

There are different configurations for using the "system logon credentials" (Kerberos authentication mechanism) for Chrome and Firefox. Chrome To config chrome you need to start the application the ...
Andy Liu - MSFT's user avatar
2 votes
Accepted

Where do I purchase token signing certificate for ADFS?

The token-signing certificate in ADFS does not care if you are using a SSL cert or code signing cert. The only requirement is the Key Usage should contain at least Digital Signature. Additionally, ...
Jimmy Sun's user avatar
  • 319
2 votes

Google Apps with AD FS 3.0 Sign out problems

The problem here is you've not been provided appropriate guidance from Google as to how to configure a SAML capable IDP such as AD FS to federate with Google apps. You should not be using adfs/ls/?wa=...
maweeras's user avatar
  • 2,744

Only top scored, non community-wiki answers of a minimum length are eligible