Skip to content

v2.3.0

Latest
Latest

Choose a tag to compare

View all tags
@canariecaf canariecaf released this 13 Nov 15:45
v2.3.0
21bbe67
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ADFSToolkit 2.3.0

Published and available on PowershellGallery.com as of Nov 13th, 2024

New Features

  • Support For Azure MFA Phone App OTP as Second Factor
  • Support for CustomAccessControl Policies
  • Support for F-TICKS collection and transmission

Adjustments / Fixes

  • Fix handling of signing algorithm assignment not working properly
  • Adjusted subject-id valid characters checks
  • Updated language settings
  • Adjusted configuration layout
  • Added ability to call ADFSTkStore to split on a given string such as pipe, comma (e.g. AL1|AL2|AL3 )
  • Updated adfstkstore version to 1.1.0.0
  • Log creation has to be done in the installation stage

New Components / Commands

Core cmdlets:

  • Get-ADFSTkLoginEvents
  • Process-ADFSTkFticks
  • Register-ADFSTkFticksScheduledTask
  • Update-ADFSTkConfiguration
  • Set-ADFSTkFticksServer

Auxiliary and helper cmdlets:

none in this release

Upgrading

Consult https://github.com/fedtools/adfstoolkit/blob/master/doc/upgrade.md for details

Known Limitations

  • If you use subject-id from pre v2.3.0 version, calculations for new subject-ids may vary from your manual ones

  • Documentation has yet to catch up to requirement of a new eventSource introduced in 2.2.1 for the Event log to properly work.
    errors in the eventlog where the ADFSTkStore cannot be initialized will happen unless this exists and requires local Administrator level shell to be created by this command:

[System.Diagnostics.EventLog]::CreateEventSource("ADFSTkTool","ADFSToolkit")

Other known limitations

  • ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested. Windows Server 2025 has not yet been tested.

  • ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
    Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:

    • AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
    • AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
      This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'.
    • AD FS' limitation never able to attest a NameID formated variable for anything other than NameID which in turn means it cannot offer proper eduPersonTargetedID in NameID format.

What's Changed

Full Changelog: v2.2.1...v2.3.0

Assets 2
Loading