- Adfstoolkit-dev - lists3.sunet.se

by Johan Peterson

Hi, Things are happening with the Powershell Module handling. Take a look at the following blog post. PSResourceGet is generally available - PowerShell Team (microsoft.com)<https://devblogs.microsoft.com/powershell/psresourceget-is-generally-availa…> I don't think we need/should run for this, but good to know and to put in our backlog. Best regards Johan Peterson IT-Architect [cid:e09b720b-e731-42a1-a9b7-468c078632a3] Digitalisation Division DIG❤️IT s-581 83 Linköping Phone: +46 (0)13-28 57 30 Mobile: +46 (0)703 222 405 Visiting address: D-Building Please visit us at liu.se E-mailing Linköping University will result in Linköping University processing your personal data. Find more information on how this is done at https://liu.se/en/article/integritetspolicy-liu

4 months, 2 weeks

1
0
0 0

Code in Dev for next RC

by johan.peterson＠liu.se

Hi, The code in Dev should now be good for the next RC. Best regards Johan Peterson IT-Architect [Linköping University] IT Department s-581 83 Linköping Phone: +46 (0)13-28 57 30 Mobile: +46 (0)703 222 405 Visiting address: Galaxen Building Please visit us at www.liu.se<http://www.liu.se/>

2 years, 5 months

1
0
0 0

Bug found in ADFS Toolkit

by johan.peterson＠liu.se

Hi, We have seen it before, some SP' s doesn't seems to be installed in the ADFS server even though they're in the metadata and when doing a manual import they import without a problem. The reason is (at least one reason) that we don't remove the SP's from the SPHash File after deletion. This means that if a SP is removed or temporarily gone from the Metadata it will be deleted from the ADFS server but not from SPHash File. When the SP is back in the metadata with the same information, the hash will be the same and therefore the Toolkit will ignore it and it will be missing in the ADFS server. This need a fix asap but is easy to do. We also have some code to evaluate/repair the situation: $Global:ADFSTkSkipMetadataSignatureCheck = $true . "C:\Program Files\WindowsPowerShell\Modules\ADFSToolkit\2.0.1\Private\Compare-ADFSTkObject.ps1" $installed = [string[]](Get-ADFSTkToolEntityId -All | select -ExpandProperty Identifier) $fromHash = [string[]](Import-Clixml "C:\ADFSToolkit\cache\Swamid-SPHashfile.xml").Keys $compare = Compare-ADFSTkObject $installed $fromHash -CompareType InSecondSetOnly foreach ($entityID in $compare.CompareSet) { Import-ADFSTkMetadata -EntityId $entityID -ConfigFile C:\ADFSToolkit\config\institution\config.Swamid.xml -ForceUpdate } Best regards Johan Peterson IT-Architect [Linköping University] IT-Department s-581 83 Linköping Phone: +46 (0)13-28 57 30 Mobile: +46 (0)703 222 405 Visiting address: D-Building Please visit us at liu.se<https://liu.se/> E-mailing Linköping University will result in Linköping University processing your personal data. Find more information on how this is done at https://liu.se/en/article/integritetspolicy-liu

2 years, 6 months

1
0
0 0

Just some info

by johan.peterson＠liu.se

Hi, I just found the following info regarding other stuff but there are detailed info about how to setup a domain controller with PS. 😊 Could come in handy if we want to setup lab/test environment on the fly… https://docs.microsoft.com/en-us/azure/active-directory/hybrid/tutorial-pas… Best regards Johan Peterson IT-Architect [Linköping University] IT Department s-581 83 Linköping Phone: +46 (0)13-28 57 30 Mobile: +46 (0)703 222 405 Visiting address: Galaxen Building Please visit us at www.liu.se<http://www.liu.se/>

2 years, 10 months

1
0
0 0

Added ClaimsBaseLine as a concept

by johan.peterson＠liu.se

Hi! As I showed you today on our weekly meeting I have started to look at how we can do testing before and after upgrades and see that the Toolkit behaves as expected. This can also be used for us when we do changes to confirm that we don’t mess thing up 😝 As a wider perspective this could also be used as a day-to-day test to measure if/when something changes the behavior of the claims calculation. This is how it looks right now if I run a test against a BaseLine where I have changed two tests in my LocalSPSettings: [cid:image001.png at 01D74D0C.5F24EA00] Best regards Johan Peterson IT-Architect [Linköping University] IT Department s-581 83 Linköping Phone: +46 (0)13-28 57 30 Mobile: +46 (0)703 222 405 Visiting address: Galaxen Building Please visit us at www.liu.se<http://www.liu.se/>

2 years, 11 months

1
0
0 0

Refeds MFA/SFA support

by johan.peterson＠liu.se

Hi, I have pushed branch #127-Add_RefedsMFA_SFA with language support. It should now be ready for RC. If you have the possibility to test the commands: Install-ADFSTkAdapter Get-ADFSTkAdapter Uninstall-ADFSTkAdapter Please do. 👍 I have one thing left to discuss: To force MFA I create an Access Control Policy: ADFSToolkit - Permit everyone and force MFA It needs a name. Is it important that the name has language support? If not all is good. If so we need to change how it is created and enabled for the SP:s in Add-ADFSTkSPRelyingPartyTrust.ps1. I can’t enable it with the ID, I need the name so in that case I first have to search for the ACP with the ID to get the name and then enable it on the SP with the name. It feels a bit messy to do so for all SP:s. Caching is always an option though 😊 What do you think? Best regards Johan Peterson IT-Architect [Linköping University] IT Department s-581 83 Linköping Phone: +46 (0)13-28 57 30 Mobile: +46 (0)703 222 405 Visiting address: Galaxen Building Please visit us at www.liu.se<http://www.liu.se/>

2 years, 11 months

1
0
0 0

added federation-settings repo to fedtools

by Chris.Phillips＠canarie.ca

Hi.. With the improvements Johan applied to the get-FederationDefaults helper, a single endpoint can contain multiple federations settings. I was working with both InCommon in a ticket and in slack with IDEM (Italy) settings for their test federation and went and configured them as well in the settings file. The repo can be found here: https://github.com/fedtools/federation-settings This is from my work location in my @teamktown github account so I’m not sure how up to date the SWAMID snapshot is. I suspect it is not the latest appropriate one. Please feel free to update it. It’s also specifically named neutrally so it can be used for more than just ADFSToolkit for federation settings like these. The ADFSToolkit docs in step 1 of the install are updated (here: https://github.com/fedtools/adfstoolkit/blob/master/doc/README.md ) to use this zip off the main branch. We may want to consider releases on it as I suspect others will want to set up their own for their federation as pull requests. Chris..

3 years

1
0
0 0

Mtg Notes: April 7: reviewing code structure to capture MFA into v2.1.0

by Chris.Phillips＠canarie.ca

Notes from April 7 standing dev meeting Attendees: Chris Phillips (CANARIE), Johan Peterson (SUNET) Topics: Continued review of code repo structure for v2.1.0 - MFA work Discussion/table top thought experiment: ‘how sustainable are our technical design decisions with the MFA items/approach?’ Notes: JP+CP: reviewed the proposed Modular separation experiemental structure (ie use a separate module) Conclusion by mid mtg by JP+CP: not very sustainable because: We would want to use this more intimately than a separate package Eg. have MFA specific directives in the customizations and LocalManualSPSettings do interesting things Separate modules breeds unnecessary duplication of code (e.g. Write-host, logging, lang packs etc) Convergence is actually quite small and not unnatural We already have assistive publish PowerShell items Only adds 3 more public methods and an included dll, code base in git will have /src for full transparency. Next steps on this front Johan opened ticket for work: https://github.com/canariecaf/adfstoolkit/issues/127 ( Add the ability to support RefedsMFA/SFA in the Toolkit ) Additional discussion about REFEDS MFA in a hybrid configuration was had Alignment to REFEDS MFA behaviour was discussed If from our codebase trigger an MFA to do the second factor trigger things, it will be more aligned to the REFEDS MFA This is similar to the Freya technique The ADFS operator has to apply the MFA rules specifically for the entity. JP+CP discussed the techniques to apply the MFA as a way to test the sustainability of the design

3 years

1
0
0 0

For Discussion: suggested git repo layout for MFA module and dll src.

by Chris.Phillips＠canarie.ca

Hi all. For tomorrow’s call I have 3 things: A prototype/mockup of work(git-ifying?) a possible git layout with the ADFSToolkitMFA module that can be seen here: https://github.com/teamktown/adfstoolkit/tree/dev I’m quite sure I added too much and welcome feedback. Dll build automation: I researched Appveyor’s capability to do the dll build validation (see: https://www.appveyor.com/docs/build-phase/ ). We have gitlab here and could deploy a runner on Windows if that makes sense instead or complement Appveyor. Thoughts on security scanning of the build artifacts are welcome as well. I also mocked up a timeline for a proposed v2.1.0 date that would include the MFA component in general availability (GA) as a conversation starter: https://timelines.gitkraken.com/timeline/c8fae9bb83b745358ff52e85c2d600b8?r… Thoughts welcome as always… Chris.

3 years, 1 month

1
0
0 0

March 10,2021 v2.0.1 Release tagged in github

by Chris.Phillips＠canarie.ca

Hi! Github is now in sync with the publish of v2.0.1 to PowershellGallery.com on March 10,2021. Note well that sites should be installing from PowerShellGallery.com Release details are below.. Chris on behalf of the ADFSToolkit team. ADFSToolkit-2.0.1 Repository: fedtools/adfstoolkit · Tag: v2.0.1 · Commit: 422898f · Released by: canariecaf ADFSToolkit 2.0.1 (Maintenance Release) Published and available on PowershellGallery.com as of March 10,2021 New Features none, this is a maintenance release. Adjustments / Fixes Resolved code signing problem where time server signature was absent due to expiring cert on March 9,2021 and required override to continue to execute as expected Resolved Institution Local Transform Rules (new to v2.0.0) not loading as expected ( canariecaf#121 ) Resolved Signature being applied to -dist files and causing challenges on copied version breaking signatures ( canariecaf#123 ) Upgrading Consult https://github.com/fedtools/adfstoolkit/blob/master/doc/upgrade.md for details New Components / Commands Core cmdlets: no new items Auxiliary and helper cmdlets: no new items Known Limitations (Unchanged from v2.0.0) ADFSToolkit is designed for AD FS on Windows 2016 or newer. It may run on older instances but has not been tested. ADFSToolkit has no known limitations itself and strives for full automation for loading a signed SAML2 aggregate. In order to accomplish this, ADFSToolkit attempts to make the 'best' choice for successfully loading an entity record under the conditions of the expected SAML2 R&E trust model. Despite these best efforts ADFSToolkit lives in an imperfect world where there are observed limitations of Microsoft AD FS meeting SAML2 and Metadata handling practices enjoyed by other tools. There may be some cases where an AD FS Administrator may need to take one time action to allow a record they need to be loaded. In each case there is a way to handle the issue however we encourage Microsoft to improve support in this area and welcome dialog on how to improve these challenges outlined below: AD FS' limitation of handling only one Relying Party encryption certificate per entity forces ADFSToolkit to choose the newest certificate as detected by certificate date it observes. This choice may conflict with how the RP decides to roll over certificates and require AD FS admin intervention to handle the rollover period more appropriately if this default is not the proper choice. AD FS' limitation of handling only a single signing certificate across all Relying Parties may require an AD FS Administrator to intervene to appropriately load the desired service on an ongoing basis via ADFSToolkit. This is acutely experienced when multiple aggregates may be configured with entities in both. In this case, the first one loaded 'wins'. — This release has 2 assets: Source code (zip) Source code (tar.gz) Visit the release page to download them.

3 years, 1 month

1
0
0 0

2024

2023

2022

2021

Adfstoolkit-dev