ADFS Claims depending on multiple conditions such as group membership and password expiry

In this post I will quickly demonstrate how to achieve a ADFS Claims depending on two different conditions. This specific case is about the password expiry claims that we only want to show for users that are member in a specific Active Directory group. First we need to add an Issuance Transform Rule where we…

Changing default ADFS Decrypt/Signing Certificate lifetime from 1 year to X years

ADFS 2.0 and above versions have a feature called AutoCertificateRollover that will automatically updates the Decrypt and Signing certificates in ADFS, and by default these certificates will have a lifetime of 1 year. If you have federations (Relying Party Trusts) configured and the Service Provider (SP) is not using the ADFS metadata file to keep…

Azure AD Connect and .NET Framework 4.7.2

Introduction Last week a discussion erupted on Microsoft forums regarding Azure AD Connect due to it’s Monitoring Agent using all free resources of CPU on the servers. These issues were caused by a .NET Framework update and a lot of administrators spent time uninstalling and blocking these patches to resolve the CPU usage issues on…

Netscaler: ADFS protected by AAA – How to handle SAML POST requests

A limitation with Netscaler AAA is that it cannot handle FormData sent in a POST request to a Netscaler LB vServer that is protected by a AAA vServer. What happens is that the Form data in the POST will not be included when the user is redirected back to the LB vServer after AAA authentication….

Using NetScaler as OpenID Connect SP with ADFS as IDP

How do you configure Citrix NetScaler OpenID Connect Service Provider with Microsoft ADFS as OpenID Connect Identity Provider? I’ve tried making it easy to understand and how you do it using CLI (NetScaler CLI and powershell). Read this post for doing this with SAML….

Using NetScaler as SAML SP with ADFS as IDP

How do you configure Citrix NetScaler SAML Service Provider with Microsoft ADFS as SAML Identity Provider? I’ve tried making it easy to understand and how you do it using CLI (NetScaler CLI and powershell). Before we begin, let us look at what we need to establish the federation: NetScaler (with at least Enterprise license) Active…

Prepopulate username with NetScalers RfWebUI

We’ve been seeing an issue with AAA in front of ADFS where credentials entered at the service provider (Office 365 for example) doesn’t populate the username in the NetScaler login, which works with ADFS. This isn’t the biggest issue, but something that makes it annoying to use AAA instead of pure ADFS. We were able…

Manually configuring Unified Gateway

I’m writing this post in English to make it easier for our non-Swedish readers. I’m going to try and explain how to configure Unified Gateway, without the wizard! I’ll try to let the commands speak for themselves, but feel free to comment if you need me to add some additional information about what I’m doing…

ADFS – Test av autentisering

Efter en installation och konfiguration av ADFS vill man säkerställa att autentisering fungerar, ett enkelt sätt att testa detta är att besöka: https://fqdn.contoso.com/adfs/ls/idpinitiatedsignon Sitter man internt, får man möjligheten att klicka på Sign In och därefter är man inloggad:   Sitter man externt får man istället möjligheten att ange användarnamn och lösenord:  

ADFS Single Sign-on med Google Chrome

Många använder Google Chrome istället för Internet Explorer i arbetet. Har man en domänjoinad dator och fungerande Single Sign-on med Internet Explorer finns det ett enkelt sätt att aktivera det för Google Chrome i ADFS, det enda som behöver göras är att lägga till en ytterligare UserAgent i paramtern för Windows Integrated Authentication (WIA) på ADFS….