命令配置 ADFS（powershell）.note

noteId: WEB04c31242007c61357c36d73de3f26b9a · 原始路径：/ALL/Windows - B模块/服务配置/ADFS+WAP+WorkFolder、Web反向代理/命令配置 ADFS（powershell）.note · 图片：3 · 附件待处理：0

 
 
1、用于workfolder：
 
新建声明感知信赖方
Add-AdfsRelyingPartyTrust -Name "WorkFolders" -Identifier "https://windows-server-work-folders/V1" -AccessControlPolicyName "Permit everyone" -Enabled $true
# 这里的Enabled $true 可以不加，默认就是enable
 
## 如果要自定义允许访问的用户组：
Add-AdfsRelyingPartyTrust -Name "WorkFolders" -Identifier "https://windows-server-work-folders/V1" -AccessControlPolicyName "Permit specific group" -AccessControlPolicyParameters "WSC2019\Manager" -Enabled $true
 
·定义信赖方属性：
后面 -IssuanceTransformRules 的值，可以先在图形化创建一个ADFS，然后创建依赖方后用命令查看：
(Get-AdfsRelyingPartyTrust).IssuanceTransformRules
 
Set-AdfsRelyingPartyTrust -TargetName "WorkFolders" -IssuanceTransformRules '@RuleName="WorkFolders" c:[Type=="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname",Issuer=="AD AUTHORITY"]=>issue(store="Active Directory",types=("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"),query=";userPrincipalName,displayName,sn,givenName;{0}",param=c.Value);'
 
 
关闭内网客户端的Windows身份认证
Set-AdfsGlobalAuthenticationPolicy -PrimaryIntranetAuthenticationProvider @("FormsAuthentication","MicrosoftPassportAuthentication")
对应截图：
 
 
·启用 ADFS：
Set­-ADFSRelyingPartyTrust -TargetIdentifier "https://windows-­server-­work-­folders/V1" -EnableJWT $true    
Set-­ADFSRelyingPartyTrust ­-TargetIdentifier "https://windows­-server­-work­-folders/V1" -Encryptclaims $false    
Set­-ADFSRelyingPartyTrust ­-TargetIdentifier "https://windows-server-­work­-folders/V1" -AutoupdateEnabled $true    
Set­-ADFSRelyingPartyTrust ­-TargetIdentifier "https://windows-­server-­work­-folders/V1" -IssueOAuthRefreshTokensTo AllDevices
 
Note：只需要grant这句授权即可,以上四句不需要
Grant-­AdfsApplicationPermission -­ServerRoleIdentifier "https://windows­-server-­work-folders/V1" -­AllowAllRegisteredClients ­-ScopeNames openid,profile
 
 
2、用于Web：
新建非声明感知信赖方
Add-AdfsNonClaimsAwareRelyingPartyTrust -Name "ADFS" -Identifier "https://extra.wsc2019.ru/" -AccessControlPolicyName "Permit everyone" -Enabled $true
 
 
·删除：
# 删除声明感知：
Remove-AdfsRelyingPartyTrust -TargetName "ADFS"
 
# 删除非声明感知：
Remove-AdfsNonClaimsAwareRelyingPartyTrust -TargetName "ADFS"