zettelkasten/26_ADFS.md at 5a108aa2b4135af0e72d7a64654b59c91b3e7032

ralfk/zettelkasten

Fork 0

Ralf Koop 5a108aa2b4 .

2023-08-25 23:29:11 +02:00

18 KiB

Raw Blame History

ADFS

Freitag, 21. September 2018

10:27

Auf dem Server BKKADFS001 im AD FS Management Tool folgende Einstellungen vornehmen.

$Computergenerierter Alternativtext: Add Retying Party Trust Wizard Reps Welcome Data Same Choose Access Contrd Reaåy to Add Trust Wäcaæ to tfæ Paty TnA Wizad Claims-zware agolicaticns corsume claims in seurit,\' tokens to make zuthentication authrization decisions, Non---cleims-vware applicatiors are web-based and use Integrated Authentication in the intern-I retwcrk can be published through \'e,€b Application Proxy Extranet access\_ @ Clans aware C) Non Clans$ {width="6.375in" height="5.510416666666667in"}

$Computergenerierter Alternativtext: SPQ-PortaI Properties Erooi-ts Proxy Erbonts Advmced Specfy sethgs Yis reb\'hg paty tn.--- Rey-ing paty•s URL: Ü)) update relying fede-ati:n meadäa däa was che:ked on relying p 3ty W\" fron$ {width="3.5625in" height="4.489583333333333in"}

Erfasster Bildschirmausschnitt: 21.09.2018 10:27

$Computergenerierter Alternativtext: SPQ-PortaI Properties Erooi-ts Proxy kd•vmced Specfy name forths reb•ing Party tn.\* Display na-re paty : https-Jhscontoso Rey-ing paty idäifte• https/fp.MS de/ / shu•epoirt$ {width="3.53125in" height="4.479166666666667in"}

Erfasster Bildschirmausschnitt: 21.09.2018 10:28

{width="3.5104166666666665in" height="4.489583333333333in"}

Erfasster Bildschirmausschnitt: 21.09.2018 10:28

$Computergenerierter Alternativtext: SPQ-PortaI Properties Erooi-ts Proxy Erbonts kdvmced Spe&y tl-e verficaten cetficäes raue\* s from ths reb\'ing$ {width="3.4895833333333335in" height="4.479166666666667in"}

Erfasster Bildschirmausschnitt: 21.09.2018 10:28

{width="3.53125in" height="4.479166666666667in"}

Erfasster Bildschirmausschnitt: 21.09.2018 10:29

{width="3.4895833333333335in" height="4.4375in"}

Erfasster Bildschirmausschnitt: 21.09.2018 10:29

{width="3.53125in" height="4.479166666666667in"}

Erfasster Bildschirmausschnitt: 21.09.2018 10:29

$Computergenerierter Alternativtext: SPQ-PcrtaI Properties Er-amon So---Aue The Wowing sf-en the proxied endpcO-ts frths reb\'ing paty This refrg is throu\$n a applicati.Tl$ {width="3.5in" height="4.489583333333333in"}

Erfasster Bildschirmausschnitt: 21.09.2018 10:29

$Computergenerierter Alternativtext: SPQ-PortaI Properties Er---Alon SO---Aue Ax---tedCISms Spe&y any rotes abo•..t the reb\'ing Party tn.---$ {width="3.5104166666666665in" height="4.4375in"}

Erfasster Bildschirmausschnitt: 21.09.2018 10:30

$Computergenerierter Alternativtext: SPQ-PortaI Properties SO---Aue kcc---tedaams secue hash to forthis p-8ty SK-ure hash \*ortthrm SHA-256$ {width="3.53125in" height="4.447916666666667in"}

Erfasster Bildschirmausschnitt: 21.09.2018 10:30

$Computergenerierter Alternativtext: Edit Claim Issuance Pclicyfor SPQ-PcraI Iswance Transform Rules The tranéorm rules the dSms that wa be Set\* to relying p arty\_ Name E-Mal x Edit - AD-LOAP-ClaimsSPQ You Can n\'e to the LDAP as an fmn how m--- to gegong Claim from the Send LDAP as LDAP Etrib_tes to outgong dSm types LDAP Rthbue (Saee ortyve to add more) - Lhqualied Names VEW La-wage Ch\*going Tyve (Select or type to add more)$ {width="9.291666666666666in" height="5.614583333333333in"}

Erfasster Bildschirmausschnitt: 21.09.2018 10:31

$Computergenerierter Alternativtext: Reiyinq Party Trusts s 9 T- patal Enabled WS-True \" SANL / WS-FSer\*on https:f.\'bxalatbkkqobloide/\_true/$ {width="9.614583333333334in" height="1.0in"}

Erfasster Bildschirmausschnitt: 21.09.2018 10:31

Auf dem Server bkkspqapp001 folgende Befehle in der SharePoint 2016 Management Shell ausführen, als Administrator. (ACHTUNG! Korrigierte Befehle unten!!!)

$adfscertPath = "d:\ADFS-fs-bkk-mobil-oil-de.cer"

$realm = "urn:spq-portal:sp2016"

$signInURL = "https://fs.bkk-mobil-oil.de/adfs/ls"

$adfscert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($adfsCertPath)

New-SPTrustedRootAuthority -Name "ADFS Token Signing Cert" -Certificate $adfscert

$emailClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming

$upnClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" -IncomingClaimTypeDisplayName "UPN" -SameAsIncoming

$roleClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" -SameAsIncoming

$sidClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid" -IncomingClaimTypeDisplayName "SID" -SameAsIncoming

$ap = New-SPTrustedIdentityTokenIssuer -Name "ADFS" -Description "ADFS provider" -realm $realm -ImportTrustCertificate $adfscert -ClaimsMappings $emailClaimMap,$upnClaimMap,$roleClaimMap,$sidClaimMap -SignInUrl $signInURL -IdentifierClaim $emailClaimmap.InputClaimType

User Profil Service - Configure Synchronisation Connections - Create New Connection

$Computergenerierter Alternativtext: Add new synchronization connection this Page to configure a connection to a directory service server to synchronize users. • a required fæld Connection Name Type Connection Settings Fu19 ualified Dornain (e.g. For Active Directory connections to Work ff\'is account must have directory sync righ& Choose which containers you Want to be synchronized. Active Directory Irnport v Fully Qualified Domain Name (e.g. contoncom): bkk•mobiloil.de Authentication Provider Type: Trusted Claims Provider Authentication v Authentication Provider Instance: Account name: )biloildeIsvc-spqProfilsyncU Example: DOMAMuser_name Password: • Confirm password: Cl Use SSL-secured connection Cl Filter out disabled users Filter in LDAP Syntax for Active Directory Import. Popel ate Containers$ {width="4.114583333333333in" height="4.25in"}

Unter Containers noch die entsprechenden OU auswählen:

Erfasster Bildschirmausschnitt: 21.09.2018 11:11

{width="4.864583333333333in" height="2.3541666666666665in"}

Erfasster Bildschirmausschnitt: 21.09.2018 11:20

Unter dieUser Profile Service Application - "Manage User Properties"

die Property "Claim User Identifier" von "SAMAccountName" auf "mail" ändern.

{width="7.25in" height="0.59375in"}

Erfasster Bildschirmausschnitt: 21.09.2018 12:23

SPQ_Profilsyncuser	8jqaDX8i6;xB	bkk-mobiloil\svc-spqProfilsyncU

Informationen zum ADFS:

get-SPTrustedIdentitytokenissuer "ADFS"

Delete the Trusted Identity Provider per Powershell:

Remove-SPClaimProvider "ADFS"

Remove-SPTrustedIdentityTokenIssuer "ADFS"

Aus <https://blogs.technet.microsoft.com/adamsorenson/2018/06/22/remove-sptrustedidentityissuer-the-trusted-login-provider-is-in-use-and-cannot-be-deleted/>

LDAPCP Erweiterung in der Farm installieren (https://github.com/Yvand/LDAPCP/releases)

*Add-SPSolution -LiteralPath "A:\Sources\SPS\LDAPCP\LDAPCP.wsp" NEUER PFAD "*A:\Sources\SPS\NewSPServer-CopyToD\Tools\Solutions"

Install-SPSolution -Identity "LDAPCP.wsp" -GACDeployment

$ap = Get-SPTrustedIdentityTokenIssuer "adfs"
$ap.ClaimProviderName = "LDAPCP"
$ap.Update()

[System.Reflection.Assembly]::Load("System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")
$publish = New-Object System.EnterpriseServices.Internal.Publish

$publish.GacInstall("A:\Sources\SPS\LDAPCP\Extract\ldapcp.dll")

LDAPCP Erweiterung in der Farm installieren (https://github.com/Yvand/LDAPCP/releases)

Add-SPSolution -LiteralPath "D:\SP\06_Solutions\LDAPCP-master\LDAPCP.wsp"

Install-SPSolution -Identity "LDAPCP.wsp" -GACDeployment

Diese Befehle können nach ca. 10 Minuten durchgeführt werden, nachdem die Solution installiert wurde.

$ap = Get-SPTrustedIdentityTokenIssuer "adfs"

$ap.ClaimProviderName = "LDAPCP"
$ap.Update()

$Computergenerierter Alternativtext: Administrator: SharePoint 2016 Management Shell PS C; Add-spsolution Solution Id Idapcp. vsp 6ff99767-bgsa-4143-8cd8-3978aaa1fb8Ø False PS Install-SPS01ution -Identity \"LDAPCP .wsp\" -GACDeploynent PS C: NUsersXcfg-spqAdmir» Sap Get-SPTrustedIdentityTokenIssuer \"ad+s\" PS C: XUsersXcfg•spqAdmir» \$ap . ClaimProviderNare - \"LDAPCP\" Set Ling . \"Claim provider With narre LDAPCP Coes not exist. 4 Sap.CIaimProwiderName - \"LDAPCP\" + Categorylnfo 4 Fullnuali+iedE-rrorId MDtSpecified: ( : ) t l, SetVa1ue1nwocationException ExceptionNhenSetting spqAdmir» PS -spqAdmir» PS C: NUsersXcfg-spqAdmir» LDAPCP PS C: NUsersXcfg-spqAdmin» PS C: \$ap. Update() Sap. claimprovidername Sap. claimprovidername \$ap. claimprwuidername Sap.Update() - \"LDAPCP\"$ {width="5.885416666666667in" height="3.2604166666666665in"}

Erfasster Bildschirmausschnitt: 26.09.2018 11:57

[System.Reflection.Assembly]::Load("System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")
$publish = New-Object System.EnterpriseServices.Internal.Publish

$publish.GacInstall("A:\Sources\SPS\LDAPCP\Extract\ldapcp.dll")

$Computergenerierter Alternativtext: Edit P rofile P roøertv SharePoint Central Administration Application Management System Settings Monitoring Backup and Restore Security Upgrade and Migration General Application Settings Apps Office 365 Configuration Wizards Site Contents Sites Edit User Profile Property this Page to edit this property for user profiles • a required fæld Property Settings Specify property Settings for this property. The name will be used prcgramrnati&ly for the propem by user profle serbce, while the display name is the label useci wien the is After the Property is Property Setting can is the dispby Sub-type of Profile Please Select the sub-type of user profiles With which you Want to asscciate this profle property. Usage This is the number of user Profi/es currentl•y containimg Values for this property. Changes to this might effect User Descripticn Specify a description for this proper-ty that pro•vide instructions o\' information to users This the Edit Details Page. Pdicy Settings S\*Cify the Privacy polig YOu Want applied to this Property. Select the Replicate Check box if pu Want the prcverty to display in the user info list for all Sites To replOte properties, the default Privacy must be set to Everyone and the User can override check box must not be EmadAdress Display Name: • Email Adress Edit Type: E-mail Default User Profile Subtype Number of profles using this property. Descriptiorr Edit Language Policy Setting: Required v Default Privacy Setting: Everyoneil Ü User can override Replicable$ {width="6.229166666666667in" height="6.46875in"}

Erfasster Bildschirmausschnitt: 26.09.2018 13:09

$Computergenerierter Alternativtext: Elft whether users can Change v.h_æs for in ther user profle. LJ\*rs With Manage Profile permission an edit any Property Value for any aser. Ihsøay Settings Specify whether or not the Property is dispaayed in the Profile properties section on the My Site Profile Page, whether property is displayed on the Edit Details Page, and whether changes to the propert/s Values are displayed in the User Profile Change Note: These display settings will obey the aser\'s Privacy seeings. Search Aliased are treated as equivalent to the user name arid åccount name when searching fot authored by a user. tat-geting Rems toa user, or disp-/aying items in the Documents Web Part of the personal Site for a wer. Alias properties must be public, Properties are by search ergine and part of the People search SCOpe Ony a if it will infænutiM1 for if Want the data displayed in pecple search results. Property for Synchronization Click rerncwe to de/ete cr an existing rnapping. Add New Specify the fied to map to this property when synchronizing user Profile dara When With a Business Data Connectivity source you can cMy import (not export) data from associated entity fields by selectimg the association. Mapping a multivalued field to a Single Value p.op•erty is allowed, will attempt to get only the first Value. be rnodif.ed Security Note: If you are using high privilege •ccount for Profile synchronization, be åble to read, import and export directory attributes thatare not normaliy viewable all Users, make Sure the appropriate defawlt Privacy Setting i5 selected. The selection of dir«tory Service may be if User Profile Appkaticn in an Wltrusted if rwt Multi Value iS \" (Mr. Ü Allow users to edit Values for this Ü Show in the Profile properties section of the user\'s Profile Page C) Show on the Edit Details Page C) Show updates to the property in newsfeed (only compatible With SharePoint 2010 newsfeeds) ÜAlias Indexed There are no tents to Show in this View. Source Data Connection: AD PS V Attribute Attribute Direction Import$ {width="5.78125in" height="4.020833333333333in"}

Erfasster Bildschirmausschnitt: 26.09.2018 13:09

Zu testen, ob dies den Fehler beseitigt.

https://nikpatel.net/2013/09/05/sharepoint-and-adfs-configuration-error-id4220-the-saml-assertion-is-either-not-signed-or-the-signatures-keyidentifier-cannot-be-resolved-to-a-securitytoken/

https://albandrodsmemory.wordpress.com/2015/06/19/sharepoint-2013-the-saml-assertion-is-either-not-signed-or-the-signature/

--- Löschen und erstellen

Umstellung der WebApplications zurück auf Windows NTLM

Remove-SPTrustedIdentityTokenIssuer "ADFS"

Neu erstellen per PS:

$adfscertPath = "d:\ADFS-Signing-fs-bkk-mobil-oil-de.cer"

$realm = "urn:sharepoint:portal-spq"

$signInURL = "https://fs.bkk-mobil-oil.de/adfs/ls"

$adfscert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($adfsCertPath)

$emailClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming

$roleClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" -SameAsIncoming

$ap = New-SPTrustedIdentityTokenIssuer -Name "ADFS" -Description "ADFS" -realm $realm -ImportTrustCertificate $adfscert -ClaimsMappings $emailClaimMap,$roleClaimMap -SignInUrl $signInURL -IdentifierClaim $emailClaimmap.InputClaimType

LDAPCP erneuern:

$ap = Get-SPTrustedIdentityTokenIssuer "adfs"

$ap.ClaimProviderName = "LDAPCP"
$ap.Update()

LDAPCP angepasst :

$Computergenerierter Alternativtext: Augmentation Enable augmentation to let LDAPCP get group membership of federated Users. lI not enabled, permissions granted on federated groups may not work Enable augmentation Select what Claim e LDAPCP will use to create claims With the rou membership of users: h /schemas.microsoftcom/ws/2008/06/identi /claims/role For Active Directory servers, the preferred Way to get groups is using UserPrincipal.GetAuthorizationGroupsC Otherwise LDAPCP reads LDAP attribute memberOf/uniquememberof of the user. LDAP Server \"Connect to SharePoint domain\": Ü Query this server g This is an Active Directory server, use UserPrincipal.GetAuthorizationGroups$ {width="14.75in" height="2.8854166666666665in"}