AD Permissions about adfsmfa HOT 7 CLOSED

Hi,

Normally, if you can register your users you should in principle have the good rights.
Is it for 2 domains in the same forest or for 2 distinct forest ?
Which version do you use?

we will test

Regards

from adfsmfa.

2.2.0.41

from adfsmfa.

Hi,

Can you download version 2.2.0.1003 and test it on Lab (with same domains)

Regards

from adfsmfa.

Upgraded to 2.2.0.1003, but the same problem remains.

• If I look at security on the user object in AD, and check the Effective Access on the ADFS service account, it has R/W to many attributes, including the MFA attributes (it does not have Full Control).
• If I login as the ADFS Service account to the primary ADFS server, I can Read and Write to the MFA attributes via the PS command Get/Set-ADUser. But when I run set-MFAUser I get access denied.
• If I give the ADFS service account Full Control to the user object it works.

Any idea of what permission that could be missing? (We would like to avoid giving Full Permission to the service account.)

from adfsmfa.

Hi,

First, I want to make it clear that the default web interface runs with the ADFS service account. and that the LDAP queries are made with the ADDS configuration information. ADFS account if nothing is specified or with the information provided in MMC.
The console and PowerShell use the interactive account connected to the ADFS server that must be an ADFS Admin (see ADFS properties). but LDAP queries are made with the informations above.

So, for example if you allow the password change, or the password reset after the first connection, or the external lockout, in principle the ADFS account is normally able to read and write the properties of all users for the domain.
You must be sure you do not have sufficient rights on your second ADDS domain. check that you have the same rights on your second domain or forest

For information, you can check or have the source code checked, when we update the attributes on the backends repositories, we always use the same method ... it's good development practice, it's an object class that do that.
In response, when we talk about read / write rights on all forest / domain, it is clear that it takes prerogatives to modify or read properties FOR ALL users.

You did not tell me if it's a second forest or a sub-domain.
However, I will still perform tests

Regards

from adfsmfa.

Hi,

No problems for me

• 2 Forests with trust relationship, sub domains.

My adfs account has read/wite all users properties and more for dealing with Connect, Change pwd, read DNS, etc..
So, i thinks you must watch for effectives rights on your first forest/domain and ensure to give the same rights on the second forest/domain.

Regards

from adfsmfa.

Thank you for verifying that.
In the end we found that it was a write permission to one of the MFA attributes that was missing for the ADFS service account on some user objects. Sorry to bother you about that, but now it works nicely.

from adfsmfa.