ADFS - Revision history

Aleks: /* Update ADFS certificates */

2024-03-14T09:05:41Z

Update ADFS certificates

← Older revision		Revision as of 10:05, 14 March 2024
Line 55:		Line 55:
	*'''Get-MsolDomain -Authentication Federated \| % { Update-MsolFederatedDomain -DomainName $_.Name -SupportMultipleDomain }'''		*'''Get-MsolDomain -Authentication Federated \| % { Update-MsolFederatedDomain -DomainName $_.Name -SupportMultipleDomain }'''

	== Update ADFS certificates ==		== Update ADFS service communications certificates ==
	Service Communications certificate + web proxy		Service Communications certificate + web proxy

	[https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/manage-ssl-certificates-ad-fs-wap Ms Learn Documentation]		[https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/manage-ssl-certificates-ad-fs-wap Ms Learn Documentation]

	[https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-ad-fs-2-dot-0-service-communications MS Learn Service comms cert change]		On Main ADFS Server import certificate and ensure that the adfs service account has permissions to the private key in cert manager:<syntaxhighlight lang="powershell">
			Set-AdfsSslCertificate -Thumbprint '<thumbprint of new cert>'
			</syntaxhighlight>Then on ADFS Proxy (WAP) Servers:<syntaxhighlight lang="powershell">
			Set-WebApplicationProxySslCertificate -Thumbprint '<thumbprint of new cert>'
			</syntaxhighlight>If the cert has expired or there are issues binding it then you will need to re-install the web application proxy:<syntaxhighlight lang="powershell">
			$cred = Get-Credential #use admin account on main adfs server
			Install-WebApplicationProxy -FederationServiceTrustCredential $cred -CertificateThumbprint '<thumbprint of new cert>' -FederationServiceName 'fs.contoso.com'
			</syntaxhighlight>[https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-ad-fs-2-dot-0-service-communications MS Learn Service comms cert change]

Aleks: /* Update Token Signing Certificate */

2024-03-14T09:00:14Z

Update Token Signing Certificate

← Older revision		Revision as of 10:00, 14 March 2024
Line 31:		Line 31:
	https://adfshelp.microsoft.com/DiagnosticsAnalyzer/Analyze		https://adfshelp.microsoft.com/DiagnosticsAnalyzer/Analyze

	==Update Token Signing Certificate==		==Update Token Signing Certificate - For entra ID==
	[https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-fed-o365-certs MS Documentation]		[https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-fed-o365-certs MS Documentation]

Line 54:		Line 54:
	If there are more than one federated domain you will need to update the token signing cert for all:		If there are more than one federated domain you will need to update the token signing cert for all:
	*'''Get-MsolDomain -Authentication Federated \| % { Update-MsolFederatedDomain -DomainName $_.Name -SupportMultipleDomain }'''		*'''Get-MsolDomain -Authentication Federated \| % { Update-MsolFederatedDomain -DomainName $_.Name -SupportMultipleDomain }'''

			== Update ADFS certificates ==
			Service Communications certificate + web proxy

			[https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/manage-ssl-certificates-ad-fs-wap Ms Learn Documentation]

			[https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/change-ad-fs-2-dot-0-service-communications MS Learn Service comms cert change]

Aleks: 9 revisions imported

2023-11-15T20:30:45Z

9 revisions imported

← Older revision	Revision as of 21:30, 15 November 2023
(No difference)

piszczynski>Aleks: /* Update Token Signing Certificate */

2023-06-29T08:30:13Z

Update Token Signing Certificate

← Older revision		Revision as of 09:30, 29 June 2023
Line 32:		Line 32:

	==Update Token Signing Certificate==		==Update Token Signing Certificate==
	[https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-fed-o365-certs ~~Doc~~]		[https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-fed-o365-certs MS Documentation]

	This can be done manually if the auto rollover feature is not enable or if there are issues.		This can be done manually if the auto rollover feature is not enable or if there are issues.

piszczynski>Aleks: /* Update Token Signing Certificate */

2023-06-29T08:29:55Z

Update Token Signing Certificate

← Older revision		Revision as of 09:29, 29 June 2023
Line 32:		Line 32:

	==Update Token Signing Certificate==		==Update Token Signing Certificate==
			[https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-fed-o365-certs Doc]

	This can be done manually if the auto rollover feature is not enable or if there are issues.		This can be done manually if the auto rollover feature is not enable or if there are issues.

piszczynski>Aleks: /* Update Token Signing Certificate */

2023-06-29T08:29:24Z

Update Token Signing Certificate

← Older revision		Revision as of 09:29, 29 June 2023
Line 48:		Line 48:
	*'''Update-MSOLFederatedDomain –DomainName <domain>'''		*'''Update-MSOLFederatedDomain –DomainName <domain>'''

	If there are multiple domains add -SupportMultipleDomain switch. Check with the following command to list the domains:		If there are multiple domains add '''-SupportMultipleDomain''' switch. Check with the following command to list the domains:
	*'''Get-MsolDomain'''		*'''Get-MsolDomain'''

	If there are more than one federated domain you will need to update the token signing cert for all:		If there are more than one federated domain you will need to update the token signing cert for all:
	*'''Get-MsolDomain -Authentication Federated \| % { Update-MsolFederatedDomain -DomainName $_.Name -SupportMultipleDomain }'''		*'''Get-MsolDomain -Authentication Federated \| % { Update-MsolFederatedDomain -DomainName $_.Name -SupportMultipleDomain }'''

piszczynski>Aleks: /* Update Token Signing Certificate */

2023-06-29T08:29:00Z

Update Token Signing Certificate

← Older revision		Revision as of 09:29, 29 June 2023
Line 39:		Line 39:

	Generate a new certificate:		Generate a new certificate:
	*Update-ADFSCertificate –CertificateType token-signing		*'''Update-ADFSCertificate –CertificateType token-signing'''

	To update the token signing certificate for Microsoft O365 you need to connect to the msol service(easist if done from the primary adfs server):		To update the token signing certificate for Microsoft O365 you need to connect to the msol service(easist if done from the primary adfs server):
	*$cred=Get-Credential		*'''$cred=Get-Credential'''
	*Connect-MsolService –Credential $cred		*'''Connect-MsolService –Credential $cred'''

	then update the token signing certificate:		then update the token signing certificate:
	*Update-MSOLFederatedDomain –DomainName <domain>		*'''Update-MSOLFederatedDomain –DomainName <domain>'''

	If there are multiple domains add -SupportMultipleDomain switch. Check with the following command to list the domains:		If there are multiple domains add -SupportMultipleDomain switch. Check with the following command to list the domains:
	*Get-MsolDomain		*'''Get-MsolDomain'''

	If there are more than one federated domain you will need to update the token signing cert for all:		If there are more than one federated domain you will need to update the token signing cert for all:
	*Get-MsolDomain -Authentication Federated \| % { Update-MsolFederatedDomain -DomainName $_.Name -SupportMultipleDomain }		*'''Get-MsolDomain -Authentication Federated \| % { Update-MsolFederatedDomain -DomainName $_.Name -SupportMultipleDomain }'''

piszczynski>Aleks: /* Update Token Signing Certificate */

2023-06-29T08:28:34Z

Update Token Signing Certificate

← Older revision		Revision as of 09:28, 29 June 2023
Line 36:		Line 36:

	Check the ADFS token signing certificates:		Check the ADFS token signing certificates:
	*Get-ADFSCertificate –CertificateType token-signing		*'''Get-ADFSCertificate –CertificateType token-signing'''

	Generate a new certificate:		Generate a new certificate:

piszczynski>Aleks at 08:28, 29 June 2023

2023-06-29T08:28:17Z

← Older revision		Revision as of 09:28, 29 June 2023
Line 30:		Line 30:

	https://adfshelp.microsoft.com/DiagnosticsAnalyzer/Analyze		https://adfshelp.microsoft.com/DiagnosticsAnalyzer/Analyze

			==Update Token Signing Certificate==

			This can be done manually if the auto rollover feature is not enable or if there are issues.

			Check the ADFS token signing certificates:
			*Get-ADFSCertificate –CertificateType token-signing

			Generate a new certificate:
			*Update-ADFSCertificate –CertificateType token-signing

			To update the token signing certificate for Microsoft O365 you need to connect to the msol service(easist if done from the primary adfs server):
			*$cred=Get-Credential
			*Connect-MsolService –Credential $cred

			then update the token signing certificate:
			*Update-MSOLFederatedDomain –DomainName <domain>

			If there are multiple domains add -SupportMultipleDomain switch. Check with the following command to list the domains:
			*Get-MsolDomain

			If there are more than one federated domain you will need to update the token signing cert for all:
			*Get-MsolDomain -Authentication Federated \| % { Update-MsolFederatedDomain -DomainName $_.Name -SupportMultipleDomain }

piszczynski>Aleks at 18:03, 29 November 2022

2022-11-29T18:03:09Z

← Older revision		Revision as of 19:03, 29 November 2022
Line 22:		Line 22:
	If this fails,		If this fails,
	Then check the ADFS servers and reboot them ( reboots are not ideal )		Then check the ADFS servers and reboot them ( reboots are not ideal )



			== ADFS tools ==

			Use tool for troubleshooting:

			https://adfshelp.microsoft.com/DiagnosticsAnalyzer/Analyze