Releases: fedtools/adfstoolkit
Release list
v2.3.0
ADFSToolkit 2.3.0
Published and available on PowershellGallery.com as of Nov 13th, 2024
New Features
- Support For Azure MFA Phone App OTP as Second Factor
- Support for CustomAccessControl Policies
- Support for F-TICKS collection and transmission
Adjustments / Fixes
- Fix handling of signing algorithm assignment not working properly
- Adjusted subject-id valid characters checks
- Updated language settings
- Adjusted configuration layout
- Added ability to call ADFSTkStore to split on a given string such as pipe, comma (e.g. AL1|AL2|AL3 )
- Updated adfstkstore version to 1.1.0.0
- Log creation has to be done in the installation stage
New Components / Commands
Core cmdlets:
- Get-ADFSTkLoginEvents
- Process-ADFSTkFticks
- Register-ADFSTkFticksScheduledTask
- Update-ADFSTkConfiguration
- Set-ADFSTkFticksServer
Auxiliary and helper cmdlets:
none in this release
Upgrading
Consult https://github.com/fedtools/adfstoolkit/blob/master/doc/upgrade.md for details
Known Limitations
-
If you use subject-id from pre v2.3.0 version, calculations for new subject-ids may vary from your manual ones
-
Documentation has yet to catch up to requirement of a new eventSource introduced in 2.2.1 for the Event log to properly work.
errors in the eventlog where the ADFSTkStore cannot be initialized will happen unless this exists and requires local Administrator level shell to be created by this command:
[System.Diagnostics.EventLog]::CreateEventSource("ADFSTkTool","ADFSToolkit")
Other known limitations
-
ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested. Windows Server 2025 has not yet been tested.
-
ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:- AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
- AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'. - AD FS' limitation never able to attest a NameID formated variable for anything other than NameID which in turn means it cannot offer proper eduPersonTargetedID in NameID format.
What's Changed
Full Changelog: v2.2.1...v2.3.0
v2.3.0-RC3
ADFSToolkit 2.3.0-RC3
Published and available on PowershellGallery.com as of Sept 30th,2024
Note you need the -allowPrerelease flag to install this version
New Features
Adjustments / Fixes
- adjusted subject-id valid characters checks
- [ x] updated language settings
New Components / Commands
- none in this release however final release will consolidate everything
Auxiliary and helper cmdlets:
- none in this release
Upgrading
Consult https://github.com/fedtools/adfstoolkit/blob/master/doc/upgrade.md for details
Known Limitations
Sep 30th, 2024
- if you use subject-id from pre v2.3.0 version, calculations for new subject-ids may vary from your manual ones
Aug 21, 2024
- Configuration layout, handling of defaults may materially change before final v2.3.0
Sept 15, 2023
- Some new features are not fully aligned with Microsoft's verb pattern and may change for final release.
- Documentation has yet to catch up to requirement of a new eventSource introduced in 2.2.1 for the Event log to properly work.
- errors in the eventlog where the ADFSTkStore cannot be initialized will happen unless this exists and requires local Administrator level shell to be created by this command:
[System.Diagnostics.EventLog]::CreateEventSource("ADFSTkTool","ADFSToolkit")Other known limitations
-
ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested.
-
ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:- AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
- AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'.
-
AD FS' limitation never able to attest a NameID formated variable for anything other than NameID which in turn means it cannot offer proper eduPersonTargetedID in NameID format.
What's Changed
- Bringing Dev into alignment with working dev branch by @teamktown in #80
Full Changelog: v2.3.0-RC1...v2.3.0-RC2
Full Changelog: v2.3.0-RC2...v2.3.0-RC3
Contributors
Assets 2
v2.3.0-RC2
ADFSToolkit 2.3.0-RC1
Published and available on PowershellGallery.com as of Aug 21th,2024
Note you need the -allowPrerelease flag to install this version
New Features
- Adjusted configuration layout
Adjustments / Fixes
New Components / Commands
- none in this release however final release will consolidate everything
Auxiliary and helper cmdlets:
- none in this release
Upgrading
Consult https://github.com/fedtools/adfstoolkit/blob/master/doc/upgrade.md for details
Known Limitations
Aug 21, 2024
- Configuration layout, handling of defaults may materially change before final v2.3.0
Sept 15, 2023
- Some new features are not fully aligned with Microsoft's verb pattern and may change for final release.
- Documentation has yet to catch up to requirement of a new eventSource introduced in 2.2.1 for the Event log to properly work.
- errors in the eventlog where the ADFSTkStore cannot be initialized will happen unless this exists and requires local Administrator level shell to be created by this command:
[System.Diagnostics.EventLog]::CreateEventSource("ADFSTkTool","ADFSToolkit")Other known limitations
-
ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested.
-
ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:- AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
- AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'.
What's Changed
- Bringing Dev into alignment with working dev branch by @teamktown in #80
Full Changelog: v2.3.0-RC1...v2.3.0-RC2
Contributors
Assets 2
v2.3.0-RC1
ADFSToolkit 2.3.0-RC1
Published and available on PowershellGallery.com as of Sept 15th,2023
Note you need the -allowPrerelease flag to install this version
New Features
- added ability to call ADFSTkStore to split on a given string such as pipe, comma (e.g. AL1|AL2|AL3 )
- 198 Added Support for CustomAccessControl Policies
- 193 Added Support for F-TICKS collection and transmission to
Adjustments / Fixes
- 198 Added Support for CustomAccessControl Policies
- Bumped versioning on adfstkstore to 1.1.0.0
- Got rid of log creation, has to be done in the installation stage
New Components / Commands
Core cmdlets:
- Get-ADFSTkLoginEvents
- Process-ADFSTkFticks
- Register-ADFSTkFticksScheduledTask
- Update-ADFSTkConfiguration
- Set-ADFSTkFticksServer
Auxiliary and helper cmdlets:
- none in this release
Upgrading
Consult https://github.com/fedtools/adfstoolkit/blob/master/doc/upgrade.md for details
Known Limitations
Sept 15, 2023
- Some new features are not fully aligned with Microsoft's verb pattern and may change for final release.
- Documentation has yet to catch up to requirement of a new eventSource introduced in 2.2.1 for the Event log to properly work.
- errors in the eventlog where the ADFSTkStore cannot be initialized will happen unless this exists and requires local Administrator level shell to be created by this command:
[System.Diagnostics.EventLog]::CreateEventSource("ADFSTkTool","ADFSToolkit")Other known limitations
-
ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested.
-
ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:- AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
- AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'.
Full Changelog: v2.2.1...v2.3.0-RC1
v2.2.1
ADFSToolkit 2.2.1
Published and available on PowershellGallery.com as of Nov 28,2022
New Features
- added new core transform rule for mailLocalAddress
- Added further support for REFEDS entity categories CodeofConductV2
Adjustments / Fixes
- Resolved problematic response by auxiliary cmdlet Get-ADFSTkToolIssueanceTransformRules.ps1 where it was not accurate in showing ‘on the fly’ transform rules ADFSToolkit calculates (no ADFS needed, can run in sandbox)
New Components / Commands
Core cmdlets:
None in this release.
Auxiliary and helper cmdlets:
- added Azure AD templates to build single AD, ADFS windows node for testing
Upgrading
Consult https://github.com/fedtools/adfstoolkit/blob/master/doc/upgrade.md for details
Known Limitations
-
ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested.
-
ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:- AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
- AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'.
Full Changelog: v2.2.0...v2.2.1
v2.2.0
ADFSToolkit 2.2.0
Published and available on PowershellGallery.com as of Oct 18,2022
New Features
- New DLL for AD FS to enable subject-id and pairwise-id natively on AD FS with ADFSToolkit with source code
- New ADFSTkStore added to facilitate subject-id and pairwise-id calculations
- Added further support for REFEDS entity categories anonymous and pseudonymous categories
Adjustments / Fixes
- Resolved double tap problem on transientid assignment that occurred within 1 millisecond during REFEDS MFA assignment by removal of millisecond portion to ensure singular claim is forced
New Components / Commands
Core cmdlets:
- Install-ADFSTkStore.ps1 - install ADFSToolkit custom store support for subject-id, pairwise-id with new DLL and supporting settings
- Uninstall-ADFSTkStore.ps1 - uninstall ADFSToolkit custom store configuration
- Get-ADFSTkStore.ps1 - work with ADFSToolkit custom store
Auxiliary and helper cmdlets:
None in this release.
Upgrading
Consult https://github.com/fedtools/adfstoolkit/blob/master/doc/upgrade.md for details
Known Limitations
-
ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested.
-
ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:- AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
- AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'.
Full Changelog: v2.1.0...v2.2.0
ADFSToolkit-2.1.0
ADFSToolkit 2.1.0
Published and available on PowershellGallery.com as of May 19,2022
New Features
- New DLL for AD FS to enable recognition of REFEDS-MFA natively on AD FS with ADFSToolkit with source code
- Startup code for the module now triggers upon module loading for improved env handling (#25)
- Adopted use of Global settings for more flexibility in commands (#25)
Adjustments / Fixes
- Resolved metadata caching for improved accuracy on how SPs should refresh
- Resolved SP overlap detection and behaviour during initial deploys
- Resolved what to do when encountering Multiple SP’s with the same domain name by assigning a prefix separator
New Components / Commands
Core cmdlets:
- Install-ADFSTkMFAAdapter.ps1 - install REFEDS MFA support with new DLL and supporting settings
- Uninstall-ADFSTkMFAAdapter.ps1 - uninstall REFEDS MFA configuration
Auxiliary and helper cmdlets:
- Get-ADFSTkToolSpInfoFromMetadata.ps1 - fetch SP info from metadata (requires configuration in place)
- Remove-ADFSTkEntityHash.ps1 - assistant cmdlet to remove entity from cache
- Get-ADFSTkMFAAdapter.ps1 - checks for REFEDS MFA configuration
Upgrading
Consult https://github.com/fedtools/adfstoolkit/blob/master/doc/upgrade.md for details
Known Limitations
-
ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested.
-
ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:- AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
- AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'.
Full Changelog: v2.0.1...v2.1.0
ADFSToolkit-2.0.1
ADFSToolkit 2.0.1 (Maintenance Release)
- Published and available on PowershellGallery.com as of March 10,2021
New Features
- none, this is a maintenance release.
Adjustments / Fixes
- Resolved code signing problem where time server signature was absent due to expiring cert on March 9,2021 and required override to continue to execute as expected
- Resolved Institution Local Transform Rules (new to v2.0.0) not loading as expected ( canariecaf#121 )
- Resolved Signature being applied to -dist files and causing challenges on copied version breaking signatures ( canariecaf#123 )
Upgrading
- Consult https://github.com/fedtools/adfstoolkit/blob/master/doc/upgrade.md for details
New Components / Commands
Core cmdlets:
- no new items
Auxiliary and helper cmdlets:
- no new items
Known Limitations (Unchanged from v2.0.0)
-
ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested.
-
ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:- AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
- AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'.
ADFSToolkit-2.0.0
ADFSToolkit 2.0.0
New Features
- More sustainable configuration layout (#25)
- Adopted use of Global settings for more flexibility in commands (#25)
- Ability to have federation specific defaults
- Improved handling of aggregate configuration
- More robust handling of Relying Party elements, specifically:
- New over ride capabilities
- Authorization conditions for services
- Transient-id/Persistent-id chosen from metadata
- improved SAML2Interop:
- Custom attribute maps available to all Relying Parties
- eduPersonPrimaryAffiliation added as attribute
- enhanced attribute transforms to handle Persistent-id better
Adjustments / Fixes
- Resolved metadata caching for improved accuracy on how SPs should refresh
- Resolved SP overlap detection and behaviour during initial deploys
- Resolved what to do when encountering Multiple SP’s with the same domain name by assigning a prefix separator
New Components / Commands
Core cmdlets:
- New-ADFSTkConfiguration - creates new overall configuration
- Enable-ADFSTkInstitutionConfiguration - enables specific aggregates
- Disable-ADFSTkInstitutionConfiguration - disables specific aggregates
- Get-ADFSTkFederationDefaults - fetches and installs federation defaults from URL
Auxiliary and helper cmdlets:
- Get-ADFSTkHealth - validates Module and installation health
- Copy-ADFSTkToolRules - copies rules between entities
- Remove-ADFSTkCache - assists with effective cleansing of cache and other elements
- Get-ADFSTkToolEntityId - assists with searching for entity IDs from the command line
Known Limitations
-
ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested.
-
ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:- AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
- AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'.
ADFSToolkit-1.0.0.0
ADFSToolkit 1.0.0.0
New Features
- adopted an improved model of partitioning user-space away from core Module to c:\ADFSToolkit<version>\ as the install root for Module instances
- Migration of config and cache to said user-space, version dependant
- New-ADFSTkConfiguration - added ability to retrieve previous configuration settings with pipelining
- New-ADFSTkConfiguration - improved language for UX during creation of configuration
New Components
- Added cmdlet Get-ADFSTkTransformRuleObjects that lists all available TransformRule Objects listed by Attribute Groups
General Items
- #19 resolved where the examples should be 'mail' not 'email' for claims
- #49 resolved (canariecaf/adfstoolkit) by abstracting SP configuration out of Module
- improved SAML2Interop: updated ADFS Relying party usage to ensure ADFS revocation checks on encryption or signing certificates are disabled
- improved SAML2Interop: added more support for reading Secure Hash SHA1/SHA256 from metadata and it's application when RP is created
Known Limitations
-
ADFSToolkit is designed for AD FS on Windows 2012r2 or newer. It may run on older 2008r2 but has not been tested.
-
ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:- AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
- AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.