Forum Discussion
NimbostratusADFS 3.0, connecting MS Web Application Proxys to Load-Balanced ADFS 3.0 Servers
Hello everyone,
I am completely stuck on figuring this one out. As we all know, ADFS 3.0 uses SNI, for testing I am using the basic tcp monitor to bring my nodes up on the pool. My nodes are two adfs 3.0 servers, tstadfs1/2. I also have two proxys, tstpx1/2. I have followed the instructions (part 1 and 5) here: https://devcentral.f5.com/articles/big-ip-and-adfs-part-5-working-with-adfs-30-and-sni with no luck.
When I try to connect the proxy to my ADFS farm, it sits there and spins, and I only get this in event viewer:
Unable to retrieve proxy configuration data from the Federation Service.
Additional Data
Trust Certificate Thumbprint: 25CC757E17BABF671434D5276AE5BEF6471C9180
Status Code: Unauthorized
Exception details: System.Net.WebException: The remote server returned an error: (401) Unauthorized. at System.Net.HttpWebRequest.GetResponse() at Microsoft.IdentityServer.Management.Proxy.StsConfigurationProvider.GetStsProxyConfiguration()
I have configured the Server SSL Profile in the Advanced settings to have my FQDN of my Federation Service Name. which in this case is: "tstadfs.test.domain.com". I am able to connect the Proxys to the ADFS nodes directly bypassing the pool, so ADFS is set up properly. I can't possibly see where I'm going wrong here.
The ADFS VS is only doing Auto Map for source address translation. I'm using the SSL Tunneling method from part 1 in the link above. Can anyone send me screenshots of their VS + Server SSL Profile configuration that has this working? Any advice is appreciated.
4 Replies
Hi denux, I'm confused. You say you are using the SSL tunneling (aka pass-through) method, however that method doesn't require any SSL profiles. What SSL profiles do you have assigned to the ADFS VS?
Mike
denux_194002Hey Mike, I just realized that a few minutes ago before I saw this. I had SSL profiles configured on the Virtual Server configuration. I removed these from the VS Config and everything now works. I was under the impression that you needed an SSL profile configured no matter what. (i'm still a little new to f5) Just so I understand completely, without any SSL profiles configured, from end-to-end the SSL traffic is staying the same and not being altered in any fashion?
That is correct. The only SNI consideration left is related to monitoring, which can be achieved using the EAV script. The one included in the iApp/deployment guide has a couple of corrections (we're in the process of adding the SSL pass-through option to the iApp as well).
- denux_194002Awesome, thanks a ton!
