A pull request for Chris Gardner’s WebApplicationProxyDSC is now inbound after a frustrating week of trying to automate the configuration of ADFS and WAP on a Server 2016 lab.
With Server 2016, the PowerShell commands to configure the ADFS and WAP servers include switches to specify a non-default port. I need to do this because the servers are behind a NetNat on a server hosting several labs, so port 443 is not available to me and I must use a different port.
This should be simple: Specify the SSLPort switch on the Install-ADFSFarm command and the HttpsPort on the Install-WebApplicationProxy command. However, when I do that, the WAP configuration fails with an error that it cannot read the FederationMetadata from the proxy.
I tried all manner of things to diagnose why this was failing and in the end, the fix is a crazy hack that should not work!
The proxy installation, despite accepting the custom port parameter, does not build the URLs correctly for the ADFS service, so is still trying to call port 443. You can set these URLs on a configured WAP service using the Set-WebApplicationProxyConfiguration command. However, when you run this command with no configured proxy, it fails.
Or so you think…
On the ADFS Server:
Install-AdfsFarmspecifiying theCertificateThumbprint,Credential,FederationServiceDisplayName,FederationServiceNameandSSLPortparams
On the WAP Server:
Install-WebApplicationProxyspecifiying theHttpsPortswitch,CertificateThumbprint,FederationServiceNameandFederationServiceTrustCredentialparams.Set-WebApplicationProxyConfigurationspecifying theADFSUrl,OAuthAuthenticationURLandADFSSignOutURLparameters with the correct URLs for your ADFS server (which include the port in the Url).- Re-run the command in step 1.
Despite the fact that step 2 says it failed, it seems to set enough information for step 3 to succeed. My experience, however, is that only doing steps 2 and 3 does not work. Weird!
As a side note, testing this lot is a lot easier if you remember that the idpinitiatedsignon.aspx page we all normally use for testing ADFS is disabled by default in Server 2016. Turn it on with Set-AdfsProperties -EnableIdPInitiatedSignonPage $true