Today i have a customer that got an Bad Request Error 400, when he try to logon to ADFS from inside their own network, with domain connected computers.
The error is only showing up in Internet Explorer, witch lead me to it might be a kerberos thing.
The service account that run the ADFS services, is “ita_service_admin”.
So looking at that account with setspn i can see witch SPN is register to ita_service_admin account.
|
1 |
setspn -l XXX\ita_service_admin |
The where no SPN for the account. The ADFS url is: https://fs.YYY.dk so i added the following SPN to ita_service_Admin account:
|
1 2 |
setspn -S HOST/FS.YYY.DK XXX\ITA_SERVICE_ADMIN setspn -S HTTP/FS.YYY.DK XXX\ITA_SERVICE_ADMIN |
But I got an error saying that HOST/FS.YYY.DK already exist. So i look for the SPN in the domain
This Code, will show all SPN in use in you Active Directory
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
cls $search = New-Object DirectoryServices.DirectorySearcher([ADSI]“”) $search.filter = “(servicePrincipalName=*)” $results = $search.Findall() #list results foreach($result in $results) { $userEntry = $result.GetDirectoryEntry() Write-host “Object Name = “ $userEntry.name -backgroundcolor “yellow” -foregroundcolor “black” Write-host “DN = “ $userEntry.distinguishedName Write-host “Object Cat. = “ $userEntry.objectCategory Write-host “servicePrincipalNames” $i=1 foreach($SPN in $userEntry.servicePrincipalName) { Write-host “SPN(“ $i “) = “ $SPN $i+=1 } Write-host “” } |
Find the SPN, and delete it from the account, i find the account under Administrator, so it looks like someone have change the service account for ADFS service from Administrator to ITA_SERVICE_ADMIN account in the past, without moving the SPN.
So delete the SPN from administrator account
|
1 |
setspn -D HOST/FS.YYY.DK XXX\administrator |
Then try to add it again to ITA_Service_Admin account.
|
1 |
setspn -S HOST/FS.YYY.DK XXX\ITA_SERVICE_ADMIN |
Restart the ADFS service, and the ADFS is working again also from Internet Explorer.