question

HippopotamusDefence-7970 avatar image
0 Votes"
HippopotamusDefence-7970 asked HippopotamusDefence-7970 commented

adfs migration 2019

Current environment: Load balancer --> Two WAP servers (each wap has local host dns file pointing to a specific adfs server) --> two adfs servers. Version is 3.0. and database is hosted in external SQL server with adfsconfiguration and artifact databases.

My plan:
Create a new 2019 in parallel with 2 wap and 2 adfs. But this time I do not want to host the database externally and use WID for new environment. So, one of the adfs server will be primary and the other secondary. My questions then:

  1. What should the architecture be like? Eg. with new WAP behind network load balancer how to best set up the backend adfs with WID since one acts as primary and the other secondary? Is it still required that the local host file of each wap point to a specific adfs? Trying to understand how the requests would be routed from load balancer to wap to adfs in such case.

  2. The current environment has custom onload.js for appending the domain name to the username and also some changes on the default placeholder names. What is the best way to migrate the current config and settings to the new one?

  3. I am not sure if artifact database is used in the current scenario. It sounds like with WID option the artifact db doesn't get installed. How to verify if that is being used currently? Or, does it even make any difference?

It would be nice to be able to create an environment in parallel, have configs and settings from current migrated over, test, and then cutover at convenience. Couldn't find a good documentation that provided at least an overview for such scenario. Most point to doing an inplace upgrade.

I have gone through
https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-sql





adfs
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

piaudonn avatar image
1 Vote"
piaudonn answered HippopotamusDefence-7970 commented

What you could do for a start is use ADFS Rapid Restore to backup your currentenvironment and restore it using WID. So you would get rid of SQL (upgrade with SQL is often more complicated).

Once you have a classic ADFS on Windows Server 2012 R2 on WID, you can add Windows Server 2019 nodes to the existing farm. And you don't have to put them on the load balancer yet. That way you can test them by using a HOSTS file on your machine.

Then you can configure your load balancer to use only the 2019 (but you keep the 2012 R2 for a little while to be able to roll back if needed).

And finally, when you are confident that the 2019 nodes are doing the job, you remove the 2012 R2 nodes and raise the behavior level of the farm.

All your JS customizations will be kept in the process as well as you entire configuration. The tweak you would have to do is if you enabled the SAML RelayState for IDP-initiated flow (as it used to be done in the .configfile on each server in 2012 R2 and is now a config to do with PowerShell in 2019).


· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you. A few more queries based on your response.

  1. To be rid of SQL, do I need to create a new 2012 r2 adfs servers to restore using adfs rapid restore? Or, do i restore on both the existing adfs servers one at a time? A summary of the procedure would be great. Since using wid, one will be primary and the other secondary would that affect the current architecture with load balancer pointing to two wap servers and each wap with local host file pointing to specific adfs server.

  2. What becomes of artifact database after moving to wid?

  3. Once 2019 servers are introduced (assuming first procedure went fine), I am assuming the existing wap doesn't need to be modified except for the local host file that point to the adfs 3 server?

Thanks again!


0 Votes 0 ·