Forum Discussion

denux_194002's avatar
denux_194002
Icon for Nimbostratus rankNimbostratus
Mar 25, 2015

ADFS 3.0, connecting MS Web Application Proxys to Load-Balanced ADFS 3.0 Servers

Hello everyone,

 

I am completely stuck on figuring this one out. As we all know, ADFS 3.0 uses SNI, for testing I am using the basic tcp monitor to bring my nodes up on the pool. My nodes are two adfs 3.0 servers, tstadfs1/2. I also have two proxys, tstpx1/2. I have followed the instructions (part 1 and 5) here: https://devcentral.f5.com/articles/big-ip-and-adfs-part-5-working-with-adfs-30-and-sni with no luck.

 

When I try to connect the proxy to my ADFS farm, it sits there and spins, and I only get this in event viewer:

 

Unable to retrieve proxy configuration data from the Federation Service.

 

Additional Data

 

Trust Certificate Thumbprint: 25CC757E17BABF671434D5276AE5BEF6471C9180

 

Status Code: Unauthorized

 

Exception details: System.Net.WebException: The remote server returned an error: (401) Unauthorized. at System.Net.HttpWebRequest.GetResponse() at Microsoft.IdentityServer.Management.Proxy.StsConfigurationProvider.GetStsProxyConfiguration()

 

I have configured the Server SSL Profile in the Advanced settings to have my FQDN of my Federation Service Name. which in this case is: "tstadfs.test.domain.com". I am able to connect the Proxys to the ADFS nodes directly bypassing the pool, so ADFS is set up properly. I can't possibly see where I'm going wrong here.

 

The ADFS VS is only doing Auto Map for source address translation. I'm using the SSL Tunneling method from part 1 in the link above. Can anyone send me screenshots of their VS + Server SSL Profile configuration that has this working? Any advice is appreciated.

 

APM
application delivery
availability
LTM
management
microsoft
security

4 Replies

Sort By
  • mikeshimkus_111's avatar
    mikeshimkus_111
    Historic F5 Account
    Mar 25, 2015

    Hi denux, I'm confused. You say you are using the SSL tunneling (aka pass-through) method, however that method doesn't require any SSL profiles. What SSL profiles do you have assigned to the ADFS VS?

     

    Mike

     

    • denux_194002's avatar
      denux_194002
      Icon for Nimbostratus rankNimbostratus
      Mar 25, 2015
      Hey Mike, I just realized that a few minutes ago before I saw this. I had SSL profiles configured on the Virtual Server configuration. I removed these from the VS Config and everything now works. I was under the impression that you needed an SSL profile configured no matter what. (i'm still a little new to f5) Just so I understand completely, without any SSL profiles configured, from end-to-end the SSL traffic is staying the same and not being altered in any fashion?
  • mikeshimkus_111's avatar
    mikeshimkus_111
    Historic F5 Account
    Mar 25, 2015

    That is correct. The only SNI consideration left is related to monitoring, which can be achieved using the EAV script. The one included in the iApp/deployment guide has a couple of corrections (we're in the process of adding the SSL pass-through option to the iApp as well).