Mailbag: All ADFS All The Time (Issue #11)
Hey y’all Mark and Tom here. Thinks are starting to return to normal so hopefully we should be back to a regular posting schedule. Tom should have some more time since HIS hockey team is already out of the playoffs while mine continues to march on. This mailbag is chalked full of ADFS goodness. Let’s get into it.
Expiring Token-Signing Certificate
Question
We have soon expiring token-signing certificates and we need to coordinate with multiple relying parties. Is there a way to use a separate token-signing certificate per replaying party?
Answer
No there is not. As Dave discussed in his ADFS Deep Dive Certificate Planning post (https://blogs.technet.com/b/askpfeplat/archive/2015/01/26/adfs-deep-dive-certificate-planning.aspx) validity period is something to consider and extending the token-signing certificate for greater than 1 year so the frequency of this type of change is not so frequent. We’ve also heard your feedback for this request.
Question
We have several RPs that are set to automatically monitor and update the relying party metadata. How often does this refresh occur and how can I check that it was checked?
Answer
It should be refreshing every 24 hours. To validate that you’ll need to use the following PowerShell command to Get-AdfsRelyingPartyTrust –Name “<your relying party trust name>”. Here is an example of my O365 RP.
You can see the LastMonitoredTime of the RP.
Question
Some of my workplace join devices are expiring after 30 days of inactive use. My environment requires me to make this longer, such as 90 days. Can you do this?
Answer
Yes you can, use the Set-ADFSDeviceRegistration –MaximumInactiveDays 90. More info can be found https://technet.microsoft.com/en-us/library/dn479315.aspx
Question
My SQL team is asking me for the exact permissions required to install ADFS DB and set permissions. Is this documented anywhere?
Answer
We’ll do you one better. The Export-ADFSDeploymentSQLScript is what you need. https://technet.microsoft.com/en-us/library/dn479308.aspx. It will output two files, one for creating the databases and one for the permissions.
Stuff from the Interwebs
This is some stuff we’ve set aside from the last few weeks. You probably found out about already but if you missed it.
-Baseball has many great things about it. One is when managers lose their minds, like this.
-We are finally getting another Dark Knight comic.
-Summer movies have started don’t miss any.
-Finally, everyone lost their mind about the Star Wars trailer, and it was cool. Let’s not forget what it could have beenwith Patton Oswalt’s great improv.
Mark ‘yes and’ Morowczynski and Tom ‘18 holes a day’ Moser