Share via

Joining new AD FS Windows Server 2019 to the old AD FS 2012 R2 farm - SPN/SOAP issues

Marcin Szumielewicz 0 Reputation points
2023-02-17T13:23:03.39+00:00

Hello,

I work with environment where I have really old setup. I tried to perform not recommended in-place upgrade, it succeed on a few common machines but it's different with AD DC... Due to complication I decided to create new DC and migrate overtime all roles from the DC01.

Machine is correctly configured and domain joined, it was promoted to DC02, replication works correctly.

At this moment there it looks like this:

  1. Windows Server 2012 R2 - DC01. Primary AD FS server. It holds all FSMO roles.
  2. Windows Server 2019 - DC02. Server that should take over all responsibilities of DC01.

Problem I have right now is to install and authorize AD FS on WS2019(DC02). Configuration Wizard is failing due to pre-requisites check:

  • There were no SPNs set on the following service account 'domain\adfs-service-account-used-by-DC01'. Specify the service account used to configure the other Federation Servers in the farm, or set host SPN for the farm on the service account.
  • SOAP security negotiation with "dc01.domain.com/adfss/services/policystoretransfer" for target "dc01.domain.com/adfss/services/policystoretransfer" failed.See inner exception for more details.
  • The specified service account could not be used to securely establish a connection with the primary federation server in the farm. Ensure that you are using the same service account as the account that you specified on the primary federation server. Occurs when user configures primary instance with account X and then tries to join a machine using account Y.
  • Unable to determine the Service SPN. There were no SPNs set on the following service account 'domain\adfs-service-account-used-by-DC01'. Specify the service account used to configure the other Federation Servers in the farm, or set host SPN for the farm on the service account.
  • Unable to determine the current Farm Behavior Level. SOAP security negotiation [...].
  • Unable to retrieve configuration from the primary server. The specified service account could not be used to securely establish a connection with the primary federation server in the farm. Ensure that you are using the same service account as the account that you specified on the primary federation server.

So far I managed to:

  • confirm that I am using correct account for 100%
  • SPNs are correctly configured
  • certifcates are correct + winrm is configured correctly(I thought that winrm could be the reason at some point)

Could you please give me any hints, advises, what could be yet wrong?

I am doing this first time and it's really confusing especially in the old setup.

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,522 questions
Windows Server 2012
Windows Server 2012
A Microsoft server operating system that supports enterprise-level management, data storage, applications, and communications.
1,546 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,015 questions
Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,211 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thameur-BOURBITA 32,606 Reputation points
    2023-02-17T13:50:47.0633333+00:00

    Hi @Shu

    You should start by checking the SPN configuration set on the old service account.

    Can you share with us the result of this command:

    setspn -l Domain\adfs-service-account-used-by-DC0

    Please don't forget to mak helpful anser as accepted*

  2. Mark Morowczynski 251 Reputation points Microsoft Employee
    2023-02-17T15:00:32.1733333+00:00

    You should not be putting ADFS on a DC. We have a free workshop next week on how to migrate from ADFS to Azure AD. I cannot stress enough you attend and retire that ADFS instance https://techcommunity.microsoft.com/t5/community-events-list/microsoft-workshops-how-to-successfully-migrate-away-from-ad-fs/m-p/3668480