Skip to content

ADFSToolkit-1.0.0.0

Choose a tag to compare

View all tags
@canariecaf canariecaf released this 18 Apr 16:03
· 460 commits to master since this release
v1.0.0.0
760b584
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

ADFSToolkit 1.0.0.0

New Features

  • adopted an improved model of partitioning user-space away from core Module to c:\ADFSToolkit<version>\ as the install root for Module instances
  • Migration of config and cache to said user-space, version dependant
  • New-ADFSTkConfiguration - added ability to retrieve previous configuration settings with pipelining
  • New-ADFSTkConfiguration - improved language for UX during creation of configuration

New Components

  • Added cmdlet Get-ADFSTkTransformRuleObjects that lists all available TransformRule Objects listed by Attribute Groups

General Items

  • #19 resolved where the examples should be 'mail' not 'email' for claims
  • #49 resolved (canariecaf/adfstoolkit) by abstracting SP configuration out of Module
  • improved SAML2Interop: updated ADFS Relying party usage to ensure ADFS revocation checks on encryption or signing certificates are disabled
  • improved SAML2Interop: added more support for reading Secure Hash SHA1/SHA256 from metadata and it's application when RP is created

Known Limitations

  • ADFSToolkit is designed for AD FS on Windows 2012r2 or newer. It may run on older 2008r2 but has not been tested.

  • ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
    Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:

    • AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
    • AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
Assets 2
Loading