Windows Federated Services - Revision history

Michael.mast: /* Enable Relay States */

2020-03-04T18:59:24Z

Enable Relay States

2020-03-04T18:51:19Z

2020-03-04T18:49:59Z

General Notes

2019-10-30T15:26:04Z

Hardening

2019-10-28T14:43:25Z

Hardening

2019-10-28T14:43:12Z

Hardening

2019-10-28T14:15:14Z

Hardening

2019-10-28T14:06:27Z

Hardening

2019-10-28T14:01:39Z

2019-10-28T13:53:25Z

Hardening

← Older revision		Revision as of 18:59, 4 March 2020
Line 83:		Line 83:
	Set-AdfsProperties -EnableRelayStateForIdpInitiatedSignOn $true		Set-AdfsProperties -EnableRelayStateForIdpInitiatedSignOn $true
	</pre>		</pre>
		+	*To obtain the relay state, you can use an online tool<ref>https://jackstromberg.com/adfs-relay-state-generator/</ref> or simply url encode the variables in the following format.
		+	<pre>https://your.domain.tld/adfs/ls/IdpInitiatedSignOn?RelayState=RPID%3Dhttps%253A%252F%252Frelyingendpoint.tld%26RelayState%3Dhttps%253A%252F%252Frelaystate.tld</pre>
		+	Or broken into it's parts<br>
		+	BaseURL :
		+	<pre>https://your.domain.tld/adfs/ls/IdpInitiatedSignOn?RelayState=RPID%3D</pre>
		+	Relying Endpoint :
		+	<pre>https%253A%252F%252Frelyingendpoint.tld</pre>
		+	Relay State URL :
		+	<pre>%3Dhttps%253A%252F%252Frelaystate.tld</pre>

@@ Line 77: / Line 77: @@
 <pre>
 Set-AdfsProperties -EnableExtranetLockout $true -ExtranetLockoutThreshold 2 -ExtranetObservationWindow (new-timespan -Minutes 30)
 </pre>

@@ Line 7: / Line 7: @@
 *Have a dedicated service account created in AD.
 *Firewall issues will get you if you are not careful
 ==Enable test page==
 <ref>https://blogs.technet.microsoft.com/rmilne/2017/06/20/how-to-enable-idpinitiatedsignon-page-in-ad-fs-2016/</ref>This is used to test sign in.<br>

@@ Line 61: / Line 61: @@
 set-adfsproperties -ExtendedProtectionTokenCheck Require
 </pre>
-*Disable unneeded and vulnerable endpoints<ref>https://dirteam.com/sander/2019/08/06/howto-disable-unnecessary-ad-fs-endpoints/</ref>
+*Disable unneeded and vulnerable endpoints<ref>https://dirteam.com/sander/2019/08/06/howto-disable-unnecessary-ad-fs-endpoints/</ref>. The following are recommended based on what I have read.
 <pre>
 Set-AdfsEndpoint -TargetAddressPath /adfs/services/trust/2005/windowstransport -Proxy $false
 Set-AdfsEndpoint -TargetAddressPath /adfs/services/trust/13/windowstransport -Proxy $false
 </pre>
 *Set time outs and softlock<ref>https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-extranet-soft-lockout-protection</ref>

@@ Line 66: / Line 66: @@
 Set-AdfsEndpoint -TargetAddressPath /adfs/services/trust/13/windowstransport -Proxy $false
 </pre>
-*Set time outs and softlock
+*Set time outs and softlock<ref>https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-extranet-soft-lockout-protection</ref>
 <pre>
 Set-AdfsProperties -EnableExtranetLockout $true -ExtranetLockoutThreshold 2 -ExtranetObservationWindow (new-timespan -Minutes 30)
 </pre>

@@ Line 56: / Line 56: @@
 ==Hardening==
-<ref>https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs</ref> The reference from Microsoft is rather vague. It looks like these settings can be applied to either the proxy or the internal server. Testing is needed.
+<ref>https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs</ref> The reference from Microsoft is rather vague. It looks like these settings can be applied to either the proxy or the internal server. Testing is needed as I am unable to find the ADFS powershell modules on a clean install of a WAP. I assume you would need to install the ADFS package, but this would defeat the purpose. For now the following is being performed on the internal server.
 *Enforce ExtendedProtectionTokenCheck <ref>https://docs.microsoft.com/en-us/powershell/module/adfs/set-adfsproperties?view=win10-ps</ref>
 <pre>
 set-adfsproperties -ExtendedProtectionTokenCheck Require
 </pre>

@@ Line 44: / Line 44: @@
 *To manage the headless server using Server Manager
 **Give the server a fqdn and manually add the DNS entry.
-**Add the server to the trusted hosts for management<ref>https://www.jorgebernhardt.com/how-to-managing-non-domain-joined-server-using-server-manager/</re>
+**Add the server to the trusted hosts for management<ref>https://www.jorgebernhardt.com/how-to-managing-non-domain-joined-server-using-server-manager/</ref>
 Note : If your trusted hosts entry is empty, then just use the set-item command without the currentlist variable.
 <pre>
@@ Line 57: / Line 57: @@
 ==Hardening==
 <ref>https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs</ref> The reference from Microsoft is rather vague. It looks like these settings can be applied to either the proxy or the internal server. Testing is needed.
-*Enforce ExtendedProtectionTokenCheck<ref>https://docs.microsoft.com/en-us/powershell/module/adfs/set-adfsproperties?view=win10-ps</ref>
+*Enforce ExtendedProtectionTokenCheck <ref>https://docs.microsoft.com/en-us/powershell/module/adfs/set-adfsproperties?view=win10-ps</ref>
 <pre>
 set-adfsproperties -ExtendedProtectionTokenCheck Require
 </pre>

← Older revision		Revision as of 13:53, 28 October 2019
Line 56:		Line 56:

	==Hardening==		==Hardening==
		+	<ref>https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs</ref> The reference from Microsoft is rather vague. It looks like these settings can be applied to either the proxy or the internal server. Testing is needed.
		+	*Enforce ExtendedProtectionTokenCheck<ref>https://docs.microsoft.com/en-us/powershell/module/adfs/set-adfsproperties?view=win10-ps</ref>
		+	<pre>
		+	set-adfsproperties -ExtendedProtectionTokenCheck Require
		+	</pre>