User required to restart session after failed authentication against secondary ADFS server about adfsmfa HOT 5 CLOSED

What do you mean with "read-only" ADFS Server ?

Can you send us detailled errorLog on the secondary server ?

We are not writing on ADFS Servers (Primary and Secondary), for example to query ExternalLockout we just perform a Get-ADFSProperties cmdlet.
The retry count, is stored in usercontext (in browser encrypted field), not on any ADFS server process.

So, for example, if the delivery Windows is elapsed, there's a direct error, no retry allowed.

Regards

from adfsmfa.

Ok, thanks for that info, read-only was not the correct expression, but not all operations work on a secondary server.

When "Invalid identification, please restart your session." shows up nothing is logged under the ADFS log on the secondary server.

When the user click OK, user gets the message "An error occurred" and in the ADFS log, Event 364 is logged with the following information:

Encountered error during federation passive request.

Additional Data

Protocol Name:
OAuthAuthorizationProtocol

Relying Party:
urn:microsoft:adfs:claimsxray

Exception details:
Microsoft.IdentityServer.Web.Authentication.External.ExternalAuthenticationException: [email protected] :
at Neos.IdentityServer.MultiFactor.AuthenticationProvider.TryLocking(AuthenticationContext usercontext, IAuthenticationContext context, IProofData proofData, HttpListenerRequest request, Claim[]& claims)
at Neos.IdentityServer.MultiFactor.AuthenticationProvider.TryEndAuthentication(IAuthenticationContext context, IProofData proofData, HttpListenerRequest request, Claim[]& claims)
at Microsoft.IdentityServer.Web.Authentication.External.ExternalAuthenticationHandlerBase.TryEndAuthentication(IAuthenticationContext authContext, IProofData proofData, HttpListenerRequest request, Claim[]& adapterClaims)
at Microsoft.IdentityServer.Web.Authentication.External.ExternalAuthenticationHandler.Process(ProtocolContext context)
at Microsoft.IdentityServer.Web.Authentication.AuthenticationOptionsHandler.Process(ProtocolContext context)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)

When we try to manually run the cmdlet on a secondary ADFS server, we get the following message:

PS C:\Windows\system32> Get-ADFSProperties
Get-ADFSProperties : PS0033: This cmdlet cannot be executed from a secondary server in a local database farm.

Hope this helps

from adfsmfa.

Hi,

Ok, we don't see the problem because this works with ADFS 2012R2, and on our 2016 platform we don't use WID (Windows Internal Database) but an SQL Server instance to prevent token replays.

We are going to broadcast the value from Primary server to all secondary servers.

Regards

from adfsmfa.

New Version 2.2.037

New Config parameter added : MaxRetries
Should work as well in ADFS 2016 Farm with multiple hosts

Regards

from adfsmfa.

Thank you for your quick handling of this issue.

from adfsmfa.