添加辅助ADFS服务器时出现安全错误

我已经按照technet上的指南创build了一个ADFS服务器。 但是， 在technet上尝试使用本指南的后半部分添加辅助ADFS服务器时，该过程将失败。

PS > Import-Module ADFS PS > $serviceAccountCredential = Get-Credential -Message "Enter the credential for the Federation Service Account." PS > Add-AdfsFarmNode ` >> -CertificateThumbprint:"REDACTED" ` >> -OverwriteConfiguration:$true ` >> -PrimaryComputerName:"awsfed01.ad.redacted.com" ` >> -ServiceAccountCredential:$serviceAccountCredential >> Add-AdfsFarmNode : MSIS7711: PolicyOperationFault At line:1 char:1 + Add-AdfsFarmNode ` + ~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [Add-AdfsFarmNode], FaultException + FullyQualifiedErrorId : DeploymentTask,Microsoft.IdentityServer.Deployment.Commands.JoinFarmCommand Message Context Status ------- ------- ------ Unable to synchronize local database... DeploymentTask Error 

以下错误现在出现在我每五分钟尝试configuration的服务器上的事件日志中：

来源：AD FS，事件ID 344 ：

 There was an error doing synchronization. Synchronization of data from the primary federation server to a secondary federation server did not occur. 

来源：AD FS，事件ID 345：

• 带有AD FS 3.0的Google Apps注销问题
• 在域中使用两台ADFS服务器有什么不好吗？
• AD FS 2.0安装在Server 2008 R2上
• ADFS和WAP与SP 2013 – loginredirect到空白页面
• ADFS代理连接到错误的ADFS

 There was a communication error during AD FS configuration database synchronization. Synchronization of data from the primary federation server to a secondary federation server did not occur. Additional Data Master Name : awsfed01.ad.redacted.com Endpoint Uri : http://awsfed01.ad.redacted.com/adfs/services/policystoretransfer Exception details: System.ServiceModel.Security.SecurityNegotiationException: The caller was not authenticated by the service. ---> System.ServiceModel.FaultException: The request for security token could not be satisfied because authentication failed. at System.ServiceModel.Security.SecurityUtils.ThrowIfNegotiationFault(Message message, EndpointAddress target) at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState) 

主ADFS服务器的安全审核日志包含审核失败，每次尝试连接时都会有以下详细信息：

 An account failed to log on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Account For Which Logon Failed: Security ID: NULL SID Account Name: msa-adfs$ Account Domain: RDC Failure Information: Failure Reason: An Error occured during Logon. Status: 0x80090302 Sub Status: 0xC0000418 Process Information: Caller Process ID: 0x0 Caller Process Name: - Network Information: Workstation Name: AWSFED20 Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): - Key Length: 0 

环境细节

• 我正在使用带有ADFS 3.0的Windows Server 2012 R2
• 我的域名是ad.redacted.com （或RDC \ ）。 另外，我有redacted.com和redacted.co.uk作为UPN。
• 我正在使用WID数据库，而不是外部SQL服务器。
• 我使用手动创build了一个名为RDC \ msa-adfs $的主要ADFS安装的gMSA服务帐户，并且在尝试configuration辅助ADFS服务器时使用同一个帐户。 我根据互联网上的各种来源将其SPNconfiguration为以下内容：
  • 主机/ adfs.ad.redacted.com
  • HTTP / ADFS
  • 主机/ adfs.ad.redacted.com
  • HTTP / ADFS
• 主ADFS服务器的名称是awsfed01.ad.redacted.com
• 辅助ADFS服务器 – 我试图configuration – 名称是awsfed02.ad.redacted.com
• adfs.ad.redacted.com有一个DNS CNAMElogging，指向awsfed01.ad.redacted.com
• 我使用由外部CA签名的SSL证书，以adfs.ad.redacted.com作为主域，并使用以下主题备用名称：
  • adfs.ad.redacted.com
  • enterpriseregistration.ad.redacted.com
  • enterpriseregistration.redacted.com
  • enterpriseregistration.redacted.co.uk
• 两个ADFS服务器都configuration了启用Windows防火墙，但networkingconfiguration为允许它们之间的所有通信

我曾尝试从空白服务器多次configuration。 每次次ADFS服务器都以相同的方式出现相同的错误消息。

更新：使用PowerShell重现

为尽可能可靠地重现此问题，我重新创build了PowerShell。

先决条件：*域控制器awsdc01域ad.redacted.com aka RDC * *两个联合服务器： awsfed10 ， awsfed20在一个名为ADFS服务器的组中

在awsdc01上：

  New-ADServiceAccount -Name msa-adfs ` -DNSHostName adfs.ad.redacted.com ` -PrincipalsAllowedToRetrieveManagedPassword "ADFS Servers" -ServicePrincipalNames "http/adfs.ad.redacted.com" 

成功执行。

在awsfed10上：

  Install-WindowsFeature adfs-federation –IncludeManagementTools Add-WindowsFeature RSAT-AD-PowerShell $password = ConvertTo-SecureString -String "Redacted" -Force -AsPlainText Import-PfxCertificate -FilePath C:\files\cert.pfx cert:\localMachine\my -Password $password Import-Module ActiveDirectory Import-Module ADFS Install-ADServiceAccount msa-adfs Install-AdfsFarm -CertificateThumbprint:"XXX" -FederationServiceName:"adfs.ad.redacted.com" -GroupServiceAccountIdentifier RDC\msa-adfs$ Initialize-ADDeviceRegistration -ServiceAccountName RDC\msa-adfs$ Enable-AdfsDeviceRegistration 

全部成功执行。

在awsfed20上：

  Install-WindowsFeature adfs-federation –IncludeManagementTools Add-WindowsFeature RSAT-AD-PowerShell $password = ConvertTo-SecureString -String "Redacted" -Force -AsPlainText Import-PfxCertificate -FilePath C:\files\cert.pfx cert:\localMachine\my -Password $password Import-Module ActiveDirectory Import-Module ADFS Install-ADServiceAccount msa-adfs Install-AdfsFarm -CertificateThumbprint:"XXX" -PrimaryComputerName:"awsfed10.ad.redacted.com" -GroupServiceAccountIdentifier RDC\msa-adfs$ 

与上面相同的错误失败。