Now let's look at a great resource that provides tools and guidance on ad FS.
Microsoft has a site at ADV, Shell, dot microsoft.com.
There are some quick links to tools at the bottom, but let's go up to the top and start with the online
tools.
Let's go to the overview page.
There's a diagnostics analyzer that you can download to your ad FS server.
You run a PowerShell command that runs a series of tests on your ADF's form and outputs a JSON file
that you can upload to the site and view the results.
I'll be showing you this in the next clip.
Then there's this claims x ray tool that lets you call ADF's using different protocols and see the claims
that are returned.
I'll show you that shortly.
But in the next module, we'll be building our own tool using ASP.NET Core to view claims.
There's a tool to help with troubleshooting the claims rules that get set up when you configure a relying
party trust with Azure AD will be configuring that type of federation later in the course.
Then there's a list of adverse events for a few different versions of ADF's.
So this website isn't just for for 2019.
There's a tool to decode JWT tokens.
And in the next module, when we examine those tokens, I'll show you another site that lets you do
this.
Also, there's a tool to examine the Federation metadata XML document that's published by your ADF's
server and that's used by partner organisations to create trusts as well as by applications.
You're federating with ADF's in order to get information about the claims published and the certificates
used for token signing.
And at the bottom there's a utility that can help you format claims values in JSON format when you're
configuring your own custom claims rules.
Let's go to the top and take a look at one of these tools claims X-ray.
In order to use this, you need to set up a relying party trust in ADF RFS for this application that
allows all the redirects to happen and the claims to be returned to this application.
Even though you aren't hosting the application itself, it's just running in the browser.
You need to run some PowerShell on your ad FS server to set up the relying party trust.
And I've actually done that already.
So let's go to the next step.
Here you enter the name of your ADF's service, which you should have a DNS entry for already.
Then you choose the authentication method you want to use and this gets sent as a query string parameter
as part of the sign in protocol.
Then you choose that protocol.
Depending on the organisation or application you're federating ADF force with, you'll choose the protocol
it supports.
We'll get into this more throughout the course.
But basically these are all open standards and you choose WCF when integrating with another ADF's server
to federate organisations, you'd use the SAML for many third party web applications like Salesforce.
So you can log in through ADF's and OAuth.
2.0 is a web standard used by modern applications for delegated authorisation.
We'll be building an application in the next module that uses 0f2 point zero.
Let's use WCF ID and click test authentication.
That opens another tab where we get redirected to the ADF.
First sign in page running on our ADF RFS server.
I log in with my credentials and we get authenticated and the claims returned by ADF's show here.
So if you want a quick way to view claims, if you're modifying claims rules in advance.
This is a tool to see the results.
There's information about the authentication method, the username user principle name, and these are
just the default claims returned.
When we get into configuring claims, you'll see how to send different claims like roles and other claims
from Active Directory and even send custom claims stored in a SQL Server database.
There's information here about how long the authentication token is valid for.
There's information about the certificate used to sign the token, and the raw token is at the bottom
in the format that's returned, which depends on the sign in protocol that was selected for WCF.
This is the SAML 1.1 token format.
Now let's go back to the claims X-ray page and let's choose the OAuth protocol for the token request.
Now we get an error and it says we need to have ad fs published to the Internet in order to use this
protocol.
You'll see how to publish HDFC later in the course.
When we install web application proxy and when we create our own app to view claims, we'll be able
to use OLA within the test environment.
Now let's go back to the top and look at another tool, the Federation Metadata Explorer.
Let's enter the name of the Federation Service again and click Get Federation metadata.
And we have a similar problem here too.
This tool only works when ADF's is published to the Internet through web application proxy.
Chances are you will be publishing your service that way.
But in the demo environment here, we're not able to use some of these tools yet.
Let's move on to the next tab on the troubleshooting page.
There are a number of common issues listed and links to aid in troubleshooting.
Now let's look at the offline tools.
These are pretty handy.
I mentioned that ADF's help isn't just intended for ADF first 2019.
So there's a link here to a GitHub project for an adapter that makes a user's password available as
an additional authentication method after another method is used as the primary.
This functionality is actually now built into ADF's 2019, so this link applies to ADF 2016.
There are some sample projects here to show you how to create custom plugins for the risk assessment
model that lets you run custom code at different stages of the ADF's claims pipeline, and I'll talk
about that later in the course too.
At the bottom here there's a link to the ADF for a rapid restore tool.
I'll be showing you that later in this module.
Back up at the top.
There are a couple more links under the reference tab and these are just references to the different
events you might find in your logs on the ADF's server and they're grouped by ADF's version.
There's also a list of error codes related to Azure sign in's with ADF.
S.
So ADF's help is a new tool that provides resources to help you with troubleshooting your ADF deployment.
Let's look at a couple of these tools in more depth next.