Some time ago we built a second ADFS farm at our datacenter. We knew we had to upgrade to v3 at some point, but wanted to keep our v2 farm intact so we could always do a rollback. We also wanted to use a new domain name for our brand new Windows 2012 R2 ADFS cluster, including the WAP proxies.
Setting all this up proved fairly easy, ADFS v3 was Continue reading ADFS v2 to v3 side by side migration for Office 365
Today while implementing a KEMP load balancing solution for ADFS v3 and WAP together with a colleague, I ran into errors on my WAP servers. Both seemed to be connected fine, the IdpInitiatedSignon.aspx page worked….but when I tried to run Get-WebApplicationProxyADFSRelyingParty in Powershell, I got 0x80075227 to chew on.
At first just ADFS+WAP, load balanced, worked, this error surfaced when we added a Non Claims Aware trust to a Sharepoint 2013 Kerberos enabled server so we could publish it using Windows Authentication (which we needed for various BI / Excel components that require Kerberos). The Sharepoint servers were also load balanced, we expect the KEMP has issues with SNI.
Connecting the WAP server directly to ADFS, without the KEMP load balancer in between solved this issue for now, we’re still looking into the configuration of the KEMP with their technicians to find a way to load balance this effectively without compromising on security.
Update: our engineer who worked with KEMP reported that an extra VIP was required because of SNI.