This blog article explains what to do if one of the certificates have changed in the IFD environment. If one of your certificates have changed in your IFD environment, our products require additional steps in order to work again.
This applies for two cases:
1) In the case of the SSL certificate
2) In the case of the Token Signing certificate
Please continue reading for a step-by-step description what to do in these cases:
…
1) In the case of the SSL certificate:
First, you need to rerun the IFD wizard and select the correct certificates (since in the web.config your old certificates are still cached). (See next screenshot)
Screenshot shows certificates in AD FS. Click to enlarge.
Then please update the “Relying Party Trust” with the new“Federation Meta Data URL” which was created in “IFD Wizard”.
If this doesn’t work correctly, you will need to delete and recreate the relying party trust for our product on the ADFS Server.
Next, specify the Federation Metadata URL, which was created by the IFD Wizard. (See next screenshot)
Screenshot shows specified Federation Metadata URL. Click to enlarge.
Next, please specify a display name. (See next screenshot).
Screenshot shows display name. Click to enlarge.
Now, select “Permit all users to access this relying party”. (See next screenshot)
Screenshot shows chosen “Permit all users to acess this relying party”. Click to enlarge.
Please check, if everything looks alright and finish the add relying party trust. (See next screenshot)
After this, you will have to add the following claim rules for this:
When the Rules Editor appears, click [Add Rule]. Otherwise, in the Relying Party Trust list, right-click the relying party object you have created before, click [Edit Claims Rules] and then click [Add Rule].
Important: Be sure, that the “Issuance Transform Rules” tab is selected. In the Claim rule template list, select the “Pass Through or Filter an Incoming Claim template” and then click [Next].
Create the following rule:
- Claim rule name: Pass Through UPN (or something descriptive)
- Add the following mapping:
1. Incoming claim type: UPN
2. Pass through all claim values
Click [Finish]
In the Rules Editor, click “Add Rule” and in the Claim rule template list, select the “Pass Through” or “Filter an Incoming Claim Template”. Click [Next] to proceed.
- Claim rule name: Pass Through Primary SID (or something descriptive)
- Add the following mapping:
1. Incoming claim type: Primary SID
2. Pass through all claim values
Click [Finish].
In the Rules Editor, click “Add Rule”
In the Claim rule template list, select the “Transform an Incoming Claim Template” and then click [Next] to continue.
Create the following rule:
- Claim rule name: Transform Windows Account Name to Name (or something descriptive)
- Add the following mapping:
1. Incoming claim type: Windows account name
2. Outgoing claim type: Name
3. Pass through all claim values
Click [Finish] and when you have created all three rules, click [OK] to close the Rules Editor.
2) In the case of the Token Signing certificate:
Please replace the old thumbprint of the “Token Signing Certificate” in the web.config with the thumbprint from your new “Token Signing Certificate”.
Here is how to find out the thumbprint. (See screenshot below)
Screenshot shows, where to find the Thumbprint. Click to enlarge.
IMPORTANT: Do not copy the thumbprint from here, type it of instead (there are hidden characters inside this string-value which can not be deleted).
This is the thumbprint in the web.config which you have to replace in this case:
Screenshot shows the “Token Signing thumbprint” in the web.config. Click to enlarge.
Please do not hesitate to contact us, if you require further information or our assistance.