Skip to content

v2.3.0-RC3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@teamktown teamktown released this 30 Sep 14:08
· 11 commits to dev since this release
v2.3.0-RC3
0bec549
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ADFSToolkit 2.3.0-RC3

Published and available on PowershellGallery.com as of Sept 30th,2024
Note you need the -allowPrerelease flag to install this version

New Features

Adjustments / Fixes

  • adjusted subject-id valid characters checks
  • [ x] updated language settings

New Components / Commands

  • none in this release however final release will consolidate everything

Auxiliary and helper cmdlets:

  • none in this release

Upgrading

Consult https://github.com/fedtools/adfstoolkit/blob/master/doc/upgrade.md for details

Known Limitations

Sep 30th, 2024

  • if you use subject-id from pre v2.3.0 version, calculations for new subject-ids may vary from your manual ones

Aug 21, 2024

  • Configuration layout, handling of defaults may materially change before final v2.3.0

Sept 15, 2023

  • Some new features are not fully aligned with Microsoft's verb pattern and may change for final release.
  • Documentation has yet to catch up to requirement of a new eventSource introduced in 2.2.1 for the Event log to properly work.
  • errors in the eventlog where the ADFSTkStore cannot be initialized will happen unless this exists and requires local Administrator level shell to be created by this command:
[System.Diagnostics.EventLog]::CreateEventSource("ADFSTkTool","ADFSToolkit")

Other known limitations

  • ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested.

  • ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model.
    Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below:

    • AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice.
    • AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit.
      This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'.

  • AD FS' limitation never able to attest a NameID formated variable for anything other than NameID which in turn means it cannot offer proper eduPersonTargetedID in NameID format.

What's Changed

  • Bringing Dev into alignment with working dev branch by @teamktown in #80

Full Changelog: v2.3.0-RC1...v2.3.0-RC2

Full Changelog: v2.3.0-RC2...v2.3.0-RC3

Contributors

teamktown
Assets 2
Loading