ADFS/WAP publish application using CBA

cthivierge 4,056 Reputation points
2020-12-03T14:41:23.317+00:00

Hi,

I have the following configuration (On Prem only)
ForestA (Windows 2016 FFL). This Domain has an ADFS farm with a WAP (all in 2016)
ForestB (Windows 2016 FFL), This Domain has a Web server (IIS 2016) and configured with Windows Authentication.

There is an internal CA in forestA that is added into the NTAuthCA of both Forests

There is a 2-way trust between ForestA and ForestB (Forest-Wide Auth.)

I have a client that is a stand alone (not member of any domain) and has a client certificate issued by the internal CA in ForestA. Does this client should be able to access the Web server in ForestB through the ADFS/WAP using Certificate Authentication ?

ADFS is configured with Certificate Authentication (external and Internal).
I have added a claim rule to map the user principal name with the UPN

WAP is publishing the web site using Preauth ADFS (Web and MSOFBA). It has to be this because the WAP in pass-through cannot forward the client certificate to the web site.

Even after this, when i try to connect using Certificate Auth. i receive a IIS error 500. From the network traces on the WAP, i can see the Kerberos error KDC_ERR_POLICY.

This should point to a Constrained delegation between domains which is not supported but i have configured using Resource-based constrained delegation...

Am i missing something ?

Thanks!

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,189 questions
Accepted answer
  1. Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee
    2020-12-04T00:48:59.72+00:00

    My understanding is that WAP always terminates the TLS tunnel and as such a CBA authentication cannot take place through a WAP publication.

    You could convert the application to Kerberos and then do a CBA between the clients and WAP and do RBCD with the backend service.

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. cthivierge 4,056 Reputation points
    2020-12-04T02:53:31.257+00:00

    Thanks @Pierre Audonnet - MSFT i do have the same understanding of the WAP and actually, it makes sense

    By the way, i do have the same issue if i configure using Forms Authentication. So it's not an issue with the Certificate authentication but more related to a double hop authentication between 2 domains.

    I will try to configure the RBCD with the IIS server and we will see ;)

    Thanks!

    0 comments