Skip to content

v2.2.1

Choose a tag to compare

View all tags
@teamktown teamktown released this 29 Nov 03:04
· 58 commits to master since this release
v2.2.1
4659211
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.

ADFSToolkit 2.2.1

Published and available on PowershellGallery.com as of Nov 28,2022

New Features

Adjustments / Fixes

  • Resolved problematic response by auxiliary cmdlet Get-ADFSTkToolIssueanceTransformRules.ps1 where it was not accurate in showing ‘on the fly’ transform rules ADFSToolkit calculates (no ADFS needed, can run in sandbox)

New Components / Commands

Core cmdlets:

None in this release.

Auxiliary and helper cmdlets:

  • added Azure AD templates to build single AD, ADFS windows node for testing

Upgrading

Consult https://github.com/fedtools/adfstoolkit/blob/master/doc/upgrade.md for details

Known Limitations

  • ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested.

  • ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
    Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:

    • AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
    • AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
      This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'.

    Full Changelog: v2.2.0...v2.2.1

Assets 2
Loading