AdfsProperties

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
FederationService Name	Key	String	Specifies the DNS name of the federation service.
AdditionalErrorPage Info	Write	String	Specifies the level of additional information that is displayed on ADFS error pages. This property is only supported in Windows Server 2019 and above.	Private, Detailed, None
Authentication ContextOrder	Write	StringArray[]	Specifies an array of authentication contexts, in order of relative strength. Specify each authentication context as a URI.
AcceptableIdentifiers	Write	StringArray[]	Specifies an array of identifiers that are acceptable names for the Federation Service when it checks the audience for claims that it receives from another claims provider.
ArtifactDbConnection	Write	String	Specifies the connection string to use for the database that maintains the artifacts that the artifact resolution service uses.
AuditLevel	Write	StringArray[]	Specifies an array of audit levels.	None, Basic, Verbose
AutoCertificate Rollover	Write	Boolean	Indicates whether the system manages certificates for the administrator and generates new certificates before the expiration date of current certificates.
CertificateCritical Threshold	Write	SInt32	Specifies the period of time, in days, prior to the expiration of a current primary signing or decryption certificate. When a certificate reaches this threshold, the Federation Service initiates the automatic certificate rollover service, generates a new certificate, and promotes it as the primary certificate. This rollover process occurs even if the critical threshold interval does not provide sufficient time for partners to replicate the new metadata. Specify a short period of time that is used only in extreme conditions when the Federation Service has not been able to generate a new certificate in advance.
CertificateDuration	Write	SInt32	Specifies the period of time, in days, that any certificates that the Federation Service generates remain valid.
Certificate GenerationThreshold	Write	SInt32	Specifies the period of time, in days, that any certificates that the Federation Service generates remain valid. The default value is 365 days.
CertificatePromotion Threshold	Write	SInt32	Specifies the period of time, in days, during which a newly generated certificate remains a secondary certificate before being promoted as the primary certificate. The default value is 5 days.
CertificateRollover Interval	Write	SInt32	Specifies the certificate rollover interval, in minutes. This value determines the frequency at which the Federation Service initiates the rollover service by polling to check whether new certificates need to be generated. The default value is 720 minutes.
CertificateThreshold Multiplier	Write	SInt32	Specifies the certificate threshold multiplier. By default, this parameter uses the number of minutes in a day (1440) as a multiplier. Change this value only if you want to use a more finely detailed measure of time, such as less than a single day, for calculating the time periods for other certificate threshold parameters.
EnableOAuthDevice Flow	Write	Boolean	Enabled the OAuth Device Flow.
HostName	Write	String	Specifies the network addressable host name of the Federation Service.
HttpPort	Write	SInt32	Specifies the HTTP port for the server.
HttpsPort	Write	SInt32	Specifies the HTTPS port for the server.
IntranetUseLocal ClaimsProvider	Write	Boolean	Indicates whether all web based requests from the intranet default to the default Active Directory claims provider. Use this parameter only when there is more than one claims provider trust in AD FS and you want all user access from the intranet to use the default Active Directory for authentication.
TlsClientPort	Write	SInt32	Specifies the port number where AD FS listens for user certificate authentication requests. Use this only when user certificate authentication is used in AD FS.
Identifier	Write	String	Specifies the URI that uniquely identifies the Federation Service.
LogLevel	Write	StringArray[]	Specifies an array of log detail. The array defines which types of events to record.	Errors, FailureAudits, Information, Verbose, SuccessAudits, Warnings, None
MonitoringInterval	Write	SInt32	Specifies the frequency, in minutes, with which the Federation Service monitors the federation metadata of relying parties and claims providers that are enabled for federation metadata monitoring.
NetTcpPort	Write	SInt32	Specifies the TCP port number for the server.
NtlmOnlySupported ClientAtProxy	Write	Boolean	Indicates whether to enable support for NTLM-based authentication in situations where the active federation server proxy does not support Negotiate method of authentication. This setting only affects the Windows transport endpoint.
PreventTokenReplays	Write	Boolean	Indicates whether the Federation Service prevents the replay of security tokens.
ExtendedProtection TokenCheck	Write	String	Specifies the level of extended protection for authentication supported by the federation server. Extended Protection for Authentication helps protect against man-in-the-middle (MITM) attacks, in which an attacker intercepts a client's credentials and forwards them to a server. Protection against such attacks is made possible through a Channel Binding Token (CBT) which can be either required, allowed or not required by the server when establishing communications with clients.	Require, Allow, None
ProxyTrustToken Lifetime	Write	SInt32	Specifies the valid token lifetime, in minutes, for proxy trust tokens. This value is used by the federation server proxy to authenticate with its associated federation server.
ReplayCache ExpirationInterval	Write	SInt32	Specifies the cache duration, in minutes, for token replay detection. This value determines the lifetime for tokens in the replay cache. When the age of a cached token exceeds this interval, the Federation Service determines the token has expired and does not allow replay of it.
SignedSamlRequests Required	Write	Boolean	Indicates whether the Federation Service requires signed SAML protocol requests from the relying party. If you specify a value of $True, the Federation Service rejects unsigned SAML protocol requests.
SamlMessageDelivery Window	Write	SInt32	Specifies the duration, in minutes, for which the Security Assertion Markup Language (SAML) messages sent by the Federation Service are considered valid.
SignSamlAuthn Requests	Write	Boolean	Indicates whether the Federation Service signs SAML protocol authentication requests to claims providers.
SsoLifetime	Write	SInt32	Specifies the duration, in minutes, of the single sign-on (SSO) experience for Web browser clients.
PersistentSso LifetimeMins	Write	SInt32	Specifies the duration, in minutes, of the persistent SSO experience.
KmsiLifetimeMins	Write	SInt32	Specifies the lifetime of the sign on status for KMSI.
EnablePersistentSso	Write	Boolean	Indicates whether to store the SSO token in persistent cookies for devices joined to a workplace.
PersistentSsoCutoff Time	Write	DateTime	Specifies the earliest issue time of accepted persistent single sign-on (SSO) tokens and OAuth refresh tokens. Persistent SSO tokens or OAuth refresh tokens issued before this time will be rejected. Use this only to reject all prior SSO state across all users and force users to provide fresh credentials.
EnableKmsi	Write	Boolean	Indicates whether to enable the Keep Me Signed In (KMSI) option for form-based authentication. KMSI is limited to providing only 24 hours of SSO. Note that a workplace joined device gets 7 days of SSO by default and does not need this option enabled.
WIASupportedUser Agents	Write	StringArray[]	Specifies an array of acceptable user agents that support seamless sign-in with Windows Integrated Authentication. If AD FS receives a token request and policy selects Windows Integrated Authentication, AD FS uses this list to determine if it needs to fall back to forms-based authentication. When the user agent for the incoming request is not in this list, AD FS falls back to forms-based authentication.
BrowserSsoSupported UserAgents	Write	StringArray[]	Specifies an array of user agents that are supported for browser SSO.
BrowserSsoEnabled	Write	Boolean	Indicates that browser single sign-on (SSO) is enabled.
LoopDetectionTime IntervalInSeconds	Write	SInt32	Specifies the time interval in seconds for AD FS to track multiple token requests that are occurring and being rejected by the relying party causing a redirect back to AD FS for a new token request. Use in conjunction with the LoopDetectionMaximumTokensIssuedInInterval parameter.
LoopDetection MaximumTokens IssuedInInterval	Write	SInt32	Specifies the maximum number of tokens that can be issued within the time period specified by the LoopDetectionTimeIntervalInSeconds parameter before AD FS will reject the request and present an error to the user. Use in conjunction with the LoopDetectionMaximumTokensIssuedInInterval parameter.
EnableLoopDetection	Write	Boolean	Indicates whether to enable loop detection. Loops occur when a relying party continuously rejects a valid security token and redirects back to AD FS. The cycle terminates after 6 loops have been detected.
ExtranetLockoutMode	Write	String	Specifies the maximum number of bad password attempts permitted against the directory before the account is throttled when accessing applications from the extranet for familiar locations. If you use Active Directory Domain Services account lockout policies, it is strongly recommended that you set this threshold to a value that is less than the threshold in AD DS to avoid lockout of the user inside and outside the network. This property is only supported in Windows Server 2019 and above.	ADFSSmartLockoutLogOnly, ADFSSmartLockoutEnforce
ExtranetLockout Threshold	Write	SInt32	Specifies the maximum number of bad password attempts permitted against the directory before the account is throttled when accessing applications from the extranet for unfamiliar locations. If you use Active Directory Domain Services account lockout policies, it is strongly recommended that you set this threshold to a value that is less than the threshold in AD DS to avoid lockout of the user inside and outside the network.
ExtranetLockout ThresholdFamiliar Location	Write	SInt32	Specifies the maximum number of bad password attempts permitted against the directory before the account is throttled when accessing applications from the extranet for familiar locations. If you use Active Directory Domain Services account lockout policies, it is strongly recommended that you set this threshold to a value that is less than the threshold in AD DS to avoid lockout of the user inside and outside the network. This property is only supported in Windows Server 2019 and above.
EnableExtranet Lockout	Write	Boolean	Indicates whether to enable the lockout algorithm for extranet. When enabled, AD FS checks attributes in Active Directory for the user before validating the credential. If the user is determined to be in lockout state, AD FS will deny the request to the user when accessing from the extranet, to prevent random login attempts from the extranet. Intranet access will continue to be validated against Active Directory.
ExtranetObservation Window	Write	String	Specifies the timespan of the lockout observation window. AD FS will reset a throttled state of an account when more than one observation window has expired since the last bad password attempt, as reported by Active Directory Domain Services. It is also possible that the last bad password field in AD DS is cleared by AD DS based on its own observation windows. In this case, AD FS will allow the request to be passed onto AD DS for validation.
ExtranetLockout RequirePDC	Write	Boolean	Specifies whether extranet lockout requires a primary domain controller (PDC).
SendClientRequestId AsQueryString Parameter	Write	Boolean	Indicates whether the client request id, or activity id, is sent as a query string on any redirect from AD FS that is sent to itself. This enables all servers in AD FS to use the same client request id when logging any messages in eventlogs, traces and audits. As a result, it is easier to troubleshoot a single request across multiple AD FS servers in the farm. The default value is $True.
GlobalRelyingParty ClaimsIssuancePolicy	Write	String	Specifies a global relying party claims issuance policy.
EnableLocal AuthenticationTypes	Write	Boolean	Indicates that local authentication types are enabled.
EnableRelayStateFor IdpInitiatedSignOn	Write	Boolean	Indicates that relay state for issuing distribution point (IDP) initiated sign-on is enabled.
DelegateService Administration	Write	String	Specifies the delegate service administration.
AllowSystemService Administration	Write	Boolean	Indicates that system service administration is allowed.
AllowLocalAdmins Service Administration	Write	Boolean	Indicates that local administrator service administration is allowed.
DeviceUsageWindowIn Days	Write	SInt32	Specifies the length of the device usage window in days.
EnableIdPInitiated SignonPage	Write	Boolean	Specifies whether to enable the EnableIdPInitiatedSignonPage property.
IgnoreTokenBinding	Write	Boolean	Specifies whether to ignore token binding.
IdTokenIssuer	Write	String	Specifies the URI of the token issuer.

Description

The AdfsProperties DSC resource manages all the associated properties for the Active Directory Federation Services (AD FS) service.

Examples

Example 1

This configuration will set the Extranet Lockout properties on the ADFS service.

Configuration AdfsProperties_Config
{
    param()

    Import-DscResource -ModuleName AdfsDsc

    Node localhost
    {
        AdfsProperties ContosoAdfsProperties
        {
            FederationServiceName    = 'sts.contoso.com'
            EnableExtranetLockout    =  $True
            ExtranetLockoutThreshold =  4
        }
    }
}