{"id":4315,"date":"2018-12-14T18:25:33","date_gmt":"2018-12-14T14:25:33","guid":{"rendered":"https:\/\/rakhesh.com\/?p=4315"},"modified":"2018-12-22T16:27:20","modified_gmt":"2018-12-22T12:27:20","slug":"adfs-2016-prompts-for-credentials-via-a-popup-and-doesnt-work","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/adfs-2016-prompts-for-credentials-via-a-popup-and-doesnt-work\/","title":{"rendered":"ADFS 2016 prompts for credentials via a popup (and doesn’t work)"},"content":{"rendered":"

Setup ADFS in my home lab. There\u2019s a single server called rak1adfs01.raxnet.global. The ADFS service is called adfs.raxnet.global and in DNS this is a CNAME to the server.\u00a0<\/p>\n

When I go to https:\/\/adfs.raxnet.global\/adfs\/ls\/IdpInitiatedSignon.htm I get a login prompt and even though I enter the correct credentials it doesn\u2019t let me in. This is unlike what I am used to at work where we get a forms based screen and that works.\u00a0<\/p>\n

To troubleshoot this I went to the authentication options on ADFS and under the Intranet section I unticked Windows Authentication and Microsoft Passport Authentication, leaving only Forms Authentication ticked.\u00a0<\/p>\n

\"Screen<\/p>\n

Restarted the ADFS service and went back to ADFS page again – voila! it signs in. So the issue is definitely the WIA authentication.\u00a0<\/p>\n

I noticed that when the prompt comes up it has my server name in it (rak1adfs.raxnet.global) rather than the ADFS service name (adfs.raxnet.global). That didn\u2019t make sense – sounded like my browser was trying to authenticate against the server directly.\u00a0<\/p>\n

\"Screen<\/p>\n

Could be an SPN issue? According to this article<\/a>\u00a0I am supposed to have an SPN of the form host\/adfs.raxnet.gloabal and that does exist.\u00a0<\/p>\n

C:\\Windows\\system32>setspn -Q host\/adfs.raxnet.global\r\nChecking domain DC=raxnet,DC=global\r\nCN=msvc_ADFS,CN=Managed Service Accounts,DC=raxnet,DC=global\r\n host\/adfs.raxnet.global\r\n\r\nExisting SPN found!<\/pre>\n
Looking at the SPNs of rak1adfs01.raxnet.global (my ADFS server) I don\u2019t see anything tying it to my service account.\u00a0I came across another article<\/a>, for a single ADFS server, which suggests setting up an SPN for http\/<servername>.\u00a0<\/p>\n
C:\\Windows\\system32>setspn -s HTTP\/rak1adfs01.raxnet.global msvc_ADFS\r\nChecking domain DC=raxnet,DC=global\r\n\r\nRegistering ServicePrincipalNames for CN=msvc_ADFS,CN=Managed Service Accounts,DC=raxnet,DC=global\r\n HTTP\/rak1adfs01.raxnet.global\r\nUpdated object<\/pre>\n
Once I did that WIA started working. (If I delete this SPN and create one for http\/adfs.raxnet.global WIA fails again. I guess my issue is that since it\u2019s a single server currently it is being treated as a single server case rather than an ADFS farm).\u00a0<\/p>\n
I went back and enabled the Forms Authentication and everything works as usual.\u00a0<\/p>\n
Lessons learnt: 1) WIA takes precedence over Forms Based Authentication; and 2) SPNs must be created against the single server if you have a single server install (even though you might be thinking of it as a farm install because you plan on installing more servers later).\u00a0<\/p>\n
As an aside, some useful links:\u00a0<\/p>\n