Add-AdfsWebApiApplication command not working in Powershell 7

[thomaslazar]

Steps to reproduce

1. Windows System with ADFS Installed
2. Have following AdfsAccessControlPolicy in place

Get-AdfsAccessControlPolicy -name "Permit specific claim"

Name           : Permit specific claim
Identifier     : Permitspecificclaim
IsBuiltIn      : False
RpUsageCount   : 4
LastUpdateTime : 25.03.2019 15:40:00
Description    :
PolicyMetadata : RequireFreshAuthentication:False
                 IssuanceAuthorizationRules:
                 {
                   Permit users
                     with <ClaimsParameter_0> in the request
                 }
                 ParameterDescription:
                 {
                   <ClaimsParameter_0>: Specify condition with ClaimType, Operator and Value using hashtable.
                 }

3. Run script from following Gist Setup-AdfsApplicationGroup.ps1

Specifically this bit is the problem.

$acl = @{
    ClaimsParameter_0 = @{ ClaimType = 'http://schemas.microsoft.com/ws/2008/06/identity/claims/role'; Operator = 'Contains'; Value = $CustomerGroup }
}

Add-AdfsWebApiApplication -ApplicationGroupIdentifier $CustomerId -Identifier "$CustomerId" -Name "$CustomerId - Web Application" -AccessControlPolicyName "Permit specific claim" -AccessControlPolicyParameters $acl -TokenLifetime 15

Expected behavior

Should run and create an AdfsWebApplication

Actual behavior

Add-AdfsWebApiApplication: ADMIN0144: SpecificClaimCondition and SpecificClaimException parameter 'ClaimsParameter_0' should be assigned through a hashtable that specifies ClaimType, Operator and Value. If multiple conditions are desired, use an array of hashtables.

Additional information

I used dotPeak to look into Microsoft.IdentityServer.dll. The problem seems to be the following check inside the ParameterInterface.cs AssignSpecificClaimParemeterFromPSHInput method , which is not working in PowerShell 7 but is working in PowerShell 5.1

if (!(value is Hashtable hashtable))
  throw new InvalidDataException(Microsoft.IdentityServer.SR.GetString("ADMIN0144", (object) specific.Label));

The content of the variable value is the content that got passed into the AccessControlPolicyParameters parameter of the Add-AdfsWebApiApplication command.

It does not matter what you put into the AccessControlPolicyParameters parameter. It always triggers this check and throws the exception.

Environment data

PS C:\Temp> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.0.0
PSEdition                      Core
GitCommitId                    7.0.0
OS                             Microsoft Windows 10.0.17763
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

[thomaslazar]

It is ADFS 2019 on Windows Server 2019. Just to clarify.

[vexx32]

Can you check (Get-Command Add-AdfsWebApiApplication).Module and ensure the module is imported as a binary module?

I'm wondering if it's being imported as a script module via Windows PS implicit remoting instead...

[thomaslazar]

PS C:\Users\lazar> (Get-Command Add-AdfsWebApiApplication).Module

 Creating implicit remoting module ...
    Getting command information from remote session ... 48 commands received
    [oooooooooooooooooooooooooooo                                                                                ]
    00:00:10 remaining.


ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     1.0                   ADFS                                {Add-AdfsAttributeStore, Add-AdfsCertificate, Add…

I got a Windows PS implicit remoting progress bar thingy though when I executed that command.

[vexx32]

Hmm. I could be wrong, but If it's that specific type check that's failing, I'd be inclined to assume that Windows PS isn't able to properly reconstruct the hashtable on that side of the remoting connection, so the type check fails.

You can try instead importing the module directly in powershell 7 with Import-Module and see if you can get it to import directly into powershell 7 without the remoting in-between.

[iSazonov]

/cc @anmenaga for information.

[anmenaga]

The content of the variable value is the content that got passed into the AccessControlPolicyParameters parameter of the Add-AdfsWebApiApplication command.

What is the runtime type of variable value ?

Couple of possible workarounds:

1. run entire script in in PowerShell 5.1 session:

$CustomerId = "TestCustomerId"
$HostName = "TestHostName"
$CustomerGroup = "TestCustomerGroup"

$s = Get-PSSession -Name WinPSCompatSession -ErrorAction SilentlyContinue
if (-not $s) {Import-Module ADFS -UseWindowsPowerShell;$s = Get-PSSession -Name WinPSCompatSession}
Invoke-Command -Session $s -ScriptBlock { Setup-AdfsApplicationGroup.ps1 $using:CustomerId $using:HostName $using:CustomerGroup }

2. as @vexx32 suggested - it is worth trying if the module actually works with PS Core:

$CustomerId = "TestCustomerId"
$HostName = "TestHostName"
$CustomerGroup = "TestCustomerGroup"

Import-Module -Name ADFS -SkipEditionCheck
Setup-AdfsApplicationGroup.ps1 $CustomerId $HostName $CustomerGroup

[thomaslazar]

@anmenaga
First workaround is working, as is just calling that script in a 5.1 PS environment

Second workaround is not working. I'm getting these errors when calling methods from the imported module.

Get-AdfsApplicationGroup: C:\Temp\Setup-AdfsApplicationGroup.ps1:14
Line |
  14 |  If (Get-AdfsApplicationGroup $CustomerId) {
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Method not found: 'Void System.ServiceModel.NetTcpBinding.set_ListenBacklog(Int32)'.

Creating Application Group: 00017
New-AdfsApplicationGroup: C:\Temp\Setup-AdfsApplicationGroup.ps1:27
Line |
  27 |  New-AdfsApplicationGroup $CustomerId
     |  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Method not found: 'Void System.ServiceModel.NetTcpBinding.set_ListenBacklog(Int32)'.
.
.
.

[thomaslazar]

And i can't really tell what the runtime type of value is, because I'm not debugging that code. I just looked into the disassembled .ddls to see where stuff could go wrong.

But I tried to explicitly make a Hashtable to pass into it.

I was only using PS7 because I like to use the new stuff for dev. So PS7 is not really a requirement for me. I just wanted to report this issue I had with PS7.

[iSazonov]

ADFS module is not supported by PowerShell Core. Please request the support in https://github.com/PowerShell/PowerShellModuleCoverage

GitHub

PowerShell/PowerShellModuleCoverage

Track issues related to using Windows PowerShell modules with PowerShell - PowerShell/PowerShellModuleCoverage

[ghost]

This issue has been marked as external and has not had any activity for 1 day. It has been be closed for housekeeping purposes.