?
Solved

ADFS not behaving as expected through load balancer

Posted on 2013-10-28
2
Medium Priority
?
864 Views
Last Modified: 2013-11-01
We are experiencing a very strange problem with our ADFS Environment.

When we connect to our ADFS Landing Page at https://adfs.mydomain.com and click the “Sign In” Button, something happens to make our workstations query DNS for a server other than adfs.mydomain.com.

This is shown in Fiddler in the highlighted portion at the lower right (shown below) where I see <h2> Object moved to <a href=’https://server-119.mydomain.com/adfs.ls/?SAMLRequest=…

See the fiddler analysis below.

Fiddler Screenshot
      
How all of our 100+ websites behave
      

1.

User enters the URL https://mywebsite.mydomain.com into their web browser to access the one of our websites.

2.

User successfully arrives at the website using that URL.

3.

User signs into the website, or clicks some links to go to other parts of the website.

4.

The code on the websites uses relative paths and the user continues to access the website at http://mywebsite.mydomain.com/pagename1.htm

5.

User clicks more links on the website.

6.

The code on the websites uses relative paths and the user continues to access the website at http://mywebsite.mydomain.com/pagename2.htm

7.

User clicks more links on the website and performs some complex tasks on the website.

8.

The code on the websites uses relative paths and the user continues to access the website at http://mywebsite.mydomain.com/pagename3.htm      
How all 100+ of our websites work
How our ADFS Website Behaves - which is totally different than all our other websites

1.

User enters the URL https://adfs.mydomain.com/adfs/ls/IdpInitiatedSignOn.aspx into their web browser to access the ADFS Landing Page.

2.

User successfully arrives at the ADFS Landing page via that URL.

3.

User clicks the "Click Continue to Sign In Button" on the ADFS Landing Page.

4.

Something, most likely code on that landing page or somewhere else inside the ADFS Server, sends back information to the web browser with the name http://server-119.mydomain.com.

5.

The User's computer then queries DNS for http://server-119.mydomain.com 

6.

The User's web browser then access http://server-119.mydomain.com directly and no longer goes through the load balancer.
How the ADFS Website Does Not Behave Like all the others.
This is my problem.

I have a feeling that ADFS has done something to IIS that is making IIS behave differently when ADFS sits inside of it, when compared to every other IIS website we have.

That’s what I need to get to the bottom of .
0
Comment
Question by:ACECORP
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 20

Accepted Solution

by:
compdigit44 earned 2000 total points
ID: 39610311
Interesting...

In IIS have your check your site binding and redirect settings?

Do you have any external DNS Cname records points to there other server name?
0
 
LVL 5

Author Closing Comment

by:ACECORP
ID: 39617526
I had to rip the environment down and rebuild it. I had to make a lot of changes, to many to list here, but I solved it :)

Thanks for your efforts.
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Active Directory security has been a hot topic of late, and for good reason. With 90% of the world’s organization using this system to manage access to all parts of their IT infrastructure, knowing how to protect against threats and keep vulnerabil…
Active Directory can easily get cluttered with unused service, user and computer accounts. In this article, I will show you the way I like to implement ADCleanup..
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question