With the introduction of the new version of ADFS in Windows Server 2016, Microsoft introduced the possibility to run ADFS in compatibility mode and to upgrade your existing configuration to ADFS 4.0 (2016).
Although the upgrade path, as described in https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016 seems to be pretty simple, there are some issues that blocked my upgrade.
If you upgrade a farm that’s using a SQL database for its configuration you might encounter the following error:
the database. You may not have permission to create the AD FS configuration database in the specified SQL server. You
can do one of the following: (1) have the SQL administrator grant permissions to you to create the AD FS configuration
database in the specified SQL server or (2) have the SQL administrator create the AD FS configuration database by
running SQL scripts. Use the Export-ADFSDeploymentSQLScript to create the SQL scripts. After the SQL administrator
runs the scripts, try the command again specifying that the database is to be overwritten.
At line:1 char:1
+ CategoryInfo : NotSpecified: (:) [Invoke-AdfsFarmBehaviorLevelRaise], RemoteException
+ FullyQualifiedErrorId : DeploymentTask,Microsoft.IdentityServer.Deployment.Commands.InvokeUpgradeFarmBehaviorCommand
Although everything seems to be correct the upgrade fails. Error which is shown is related to install-adfsfarm (which probably is started within this command). In my situation this was not a proper solution because the following error was that the database already existed and the an overwrite parameter should be provided. This parameter is not possible in Invoke-AdfsFarmBehaviorLevelRaise.
In my situation the proper solution was explicitly provide a domain admin / SQL Admin account to Invoke-AdfsFarmBehaviorLevelRaise:
Invoke-AdfsFarmBehaviorLevelRaise -Credential (get-credential)
Afterwards the upgrade was successful.
WAP Published Application Issues
In my configuration I had some applications named “Application 1 (url:https://application.com/app)“. This was perfectly working on WAP 2012 R2, but in WAP 2016 it stopped to work resulting in a HTTP 500 error in in the client and a eventlog entry with eventid 12019:
Web Application Proxy could not create a listener for the following URL: https://application.com/app/.
Cause: The filename, directory name, or volume label syntax is incorrect.
Somehow WAP 2016 cannot work with slashes in the name of the published application name.
The easiest way to solve this issue is to run the following command in the WAP node (as Administrator):
Please note that you should run this on the existing 2012 R2 node when still running in compatibility mode.
Upgrade WAP 2012 R2 to WAP 2016 configuration version
I couldn’t find any official procedures for upgrading the WAP 2012 R2 configuration level to WAP 2016, so let me briefly describe how to do it. I’ts quite easy. To fully leverage the functionality of the Web Application Proxy role in Server 2016 you need to run the following command on a WAP 2016 node:
Documentation for the Set-WebApplicationProxyConfiguration command is found at https://technet.microsoft.com/en-us/library/dn283406.aspx.
Removing offline ADFS Farm Members
My lab ADFS farm is a farm where I did a lot of experiencing with ADFS 3.0. During the Technical Preview Period of Server 2016 I also had an ADFS 2016 farm node running in this farm for a while. And, all against the rules, I did not remove that node correctly. This farm node still exists in the ADFS configuration database and blocked the upgrade to ADFS 2016.
The official way to remove a ADFS farm node from a ADFS farm is by entering the following command:
Uninstall-WindowsFeature ADFS-Federation -IncludeManagementTools
But how to remove a farm member when it’s offline? You could use SQL to remove the specific farm node from the farm. Let me make a pre-caution here, this is not a supported way to do but in my situation it helped.
- Open SQL Management Studio and select to the ADFSConfigurationDatabase.
- Open a New Query
Enter the following command to remove the node by using the FQDN of this node (you could consider to first query the table before actually remove this line):
Now this final blocker was removed to upgrade I was able upgrade to ADFS 2016 finaly.