ADFS Task, what does it do?

jackson19 · September 16, 2021, 12:47am

Hey all, once a year I have to go through the heartache of updating my ADFS cert, and I’m wondering if this is the year I try to switch this one to a LE cert.

I love the ease of use that the CTW app provides. However, I’m certainly not an ADFS expert, so I worry about “doing it wrong” and having to fight unwinding how to fix.

If it’s not proprietary, could anyone share what all the deploy to ADFS task does?

Also, anyone have any advice on a process to use CTW to push the cert to WAPs as well?

webprofusion · September 16, 2021, 3:04am

Hi, yes we do have a built-in ADFS task for basic deployment, it’s worth noting that I’m not at all skilled with ADFS, so the script we have is based on user examples. That said, it seems to work well for basic use.

It certainly wise to be cautious and try it out on a test system, but if you review the code you can probably see you should be able to fix anything it does via the normal administrative UI.

You could optionally use a PowerShell scripting task and do the same thing with custom changes:

github.com

webprofusion/certify-plugins/blob/master/src/DeploymentTasks/Core/Providers/Assets/ADFS.ps1

param($result, [switch] $restartServices = $false, [switch] $alternateTlsBinding = $false)
            
# https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/manage-ssl-certificates-ad-fs-wap

Set-AdfsCertificate -CertificateType Service-Communications -Thumbprint $result.ManagedItem.CertificateThumbprintHash -Confirm:$false

Set-AdfsSslCertificate -Thumbprint $result.ManagedItem.CertificateThumbprintHash -ErrorAction Stop -Confirm:$false

# primary AD FS with Alternate TLS binding
if ( $alternateTlsBinding -eq $true) {
    Set-AdfsAlternateTlsClientBinding -Thumbprint $result.ManagedItem.CertificateThumbprintHash -ErrorAction Stop -Confirm:$false
} 

if ( $restartServices -eq $true) {

    Restart-Service WinHttpAutoProxySvc
    Restart-Service W3SVC
    Restart-Service adfssrv
}

webprofusion · September 16, 2021, 3:10am

I can’t advise on Windows Web Application Proxy (which I presume is what you mean by WAP, not a mobile website from 15 years ago!) but if you can find a powershell script that updates the current ssl certificate for that then I could help you adapt that here.

From Set-WebApplicationProxySslCertificate (WebApplicationProxy) | Microsoft Docs it looks like you could perhaps use:

param($result)

 Set-WebApplicationProxySslCertificate -Thumbprint $result.ManagedItem.CertificateThumbprintHash

However you may also need to a task to restart the WAP service (if required).

webprofusion · September 16, 2021, 3:12am

Note that all these examples assume the certificate is already installed into the local machine certificate store under Personal/My, before running the script, which is the default case if you are running this on the same machine that Certify has renewed the certificate on.