Hi All,
We are in the process of implementing ADFS 3.0 published to the internet for o365 Federation purposes.
The setup consists of the following
- 2 x windows 2012 R2 running ADFS 3.0 ( only one server presently installed and configured though)
- 2 x Windows 2012 R2 Running Web Application Proxy ( only one server presently installed and configured though ).
There is an F5 Big-IP load-balancer for both internal and external interfaces and it has been configured after a lot of issues with the SNI part on the F5.
So, in short the setup is now a single server hosting ADFS 3.0 using SQL and a single WAP server, however the traffic to these servers are still going through the LB.
Now the issue is that i cannot complete the installation/configuration of the Web Application Proxy server. There is a firewall in between our DMZ and the internal network. I can reach the internal services via the following url and telnet on port 443 to the federation service as well. (ports for 443 and 80) are opened to internal network on the load balancer ip . I can reach https://fs.domain.com/adfs/ls/idpinitiatedsignon.aspx and federationmetadata/2007-06/federationmetadata.xml location as well from the Web APplication proxy server without any issues or certificate prompts at all.
When i do the configuration for WAP, i use the same account which was used as a service account for the ADFS service internally. If i use a local admin account, it errors out with another message stating the connection was closed.
The certificate on the internal server along with its private key was exported and has been imported on the WAP server . This is not internal CA, instead we are using DIGICERT SSL with SAN Names for enterprise registration and work folders. Hence the CA Chain issue is ruled out and also this is not a wild card certificate.
When the wizard starts configuring, it does establish the trust with the federation service which is shown up in the event viewer with EventID 391 within 15 seconds i get another event id 422 which states that it cannot retrieve the proxy configuration and eventid 276 on the Federation server which states the authentication failure. this continues until the servers stops to try configuring the wizard.
I have read all the available threads on the 3.0 WAP installation /configuraiton problem and tried all the steps possible but i am still stuck with this issue.
There is one more part that i noticed on the ADFS server, that the self signed services for the token-encrypting and token decrypting are self-signed certificates. Also, in the certificates it was showing up as not trusted. and i installed them to the TRUSTED ROOT CERTIFICATION STORE after wich i cannot see any private key showing up when viewing the certificate which means i cannot get the MANAGE PRIVATE keys option when right clicking on the cert to assign read permissions for the ADFS service account.
Should i assign the same SSL sertificate (SAN based for enterpriseregistration & Workfolders) to the token-encrypting and token-decrypting services in ADFS console or should i leave them as self signed ? I did read that self-signed is not recommended for production environment ? If not the same certificate what are the requirements for the certificate ?
I am not sure what I am missing in the configuration that is causing this issue. The WAP servers are not part of the domain and have also ensured the time synchronization between the domain machine as well.
The service name is fs.domain.com on both the internal and external DNS ( we have domain.com as a zone in DNS internally as well ). I am able to Authenticate inside and from the WAP server when accessing the link.
Could it be a Load Balancer Configuration ? [i will try eliminating this from the configuration]
Let me know if there are any options that i can try to resolve this and get the configuration working.
Cheers,