DSCResources/MSFT_AdfsRelyingPartyTrust/en-US/about_AdfsRelyingPartyTrust.help.txt
|
.NAME
AdfsRelyingPartyTrust .DESCRIPTION The AdfsRelyingPartyTrust DSC resource manages the relying party trusts of the Federation Service. .PARAMETER Name Key - String Specifies the friendly name of this relying party trust. .PARAMETER AccessControlPolicyName Write - String Specifies the name of an access control policy. .PARAMETER AccessControlPolicyParameters Write - String Specifies the parameters and their values to pass to the Access Control Policy. .PARAMETER AdditionalAuthenticationRules Write - String Specifies the additional authorization rules to require additional authentication based on user, device and location attributes after the completion of the first step of authentication. Note: These rules must only be configured after there is at least one authentication provider enabled for additional authentication. .PARAMETER AdditionalWSFedEndpoint Write - String Specifies an array of alternate return addresses for the application. This is typically used when the application wants to indicate to AD FS what the return URL should be on successful token generation. AD FS requires that all acceptable URLs are entered as trusted information by the administrator. .PARAMETER AutoUpdateEnabled Write - Boolean Indicates whether changes to the federation metadata by the MetadataURL parameter apply automatically to the configuration of the trust relationship. If this parameter has a value of True, partner claims, certificates, and endpoints are updated automatically. .PARAMETER ClaimAccepted Write - String Specifies an array of claims that this relying party accepts. .PARAMETER ClaimsProviderName Write - String Specifies the name of the claim provider. .PARAMETER DelegationAuthorizationRules Write - String Specifies the delegation authorization rules for issuing claims to this relying party. .PARAMETER Enabled Write - Boolean Indicates whether the relying party trust is enabled. .PARAMETER EnableJWT Write - Boolean Indicates whether the JSON Web Token (JWT) format should be used to issue a token on a WS-Federation request. By default, SAML tokens are issued over WS-Federation. .PARAMETER EncryptClaims Write - Boolean Indicates whether the claims that are sent to the relying party are encrypted. .PARAMETER EncryptedNameIdRequired Write - Boolean Indicates whether the relying party requires that the NameID claim be encrypted. .PARAMETER EncryptionCertificateRevocationCheck Write - String Allowed values: None, CheckEndCert, CheckEndCertCacheOnly, CheckChain, CheckChainCacheOnly, CheckChainExcludeRoot, CheckChainExcludeRootCacheOnly Specifies the type of validation that should occur for the encryption certificate it is used for encrypting claims to the relying party. .PARAMETER Identifier Write - String Specifies the unique identifiers for this relying party trust. No other trust can use an identifier from this list. Uniform Resource Identifiers (URIs) are often used as unique identifiers for a relying party trust, but you can use any string of characters. .PARAMETER ImpersonationAuthorizationRules Write - String Specifies the impersonation authorization rules for issuing claims to this relying party. .PARAMETER IssuanceAuthorizationRules Write - String Specifies the issuance authorization rules for issuing claims to this relying party. .PARAMETER IssuanceTransformRules Write - String Specifies the issuance transform rules for issuing claims to this relying party. .PARAMETER MetadataUrl Write - String Specifies a URL at which the federation metadata for this relying party trust is available. .PARAMETER MonitoringEnabled Write - Boolean Indicates whether periodic monitoring of this relying party federation metadata is enabled. The MetadataUrl parameter specifies the URL of the relying party federation metadata. .PARAMETER NotBeforeSkew Write - Sint32 Specifies the skew, as in integer, for the time stamp that marks the beginning of the validity period. .PARAMETER Notes Write - String Specifies notes for this relying party trust. .PARAMETER ProtocolProfile Write - String Allowed values: SAML, WsFederation, WsFed-SAML Specifies which protocol profiles the relying party supports. .PARAMETER SamlResponseSignature Write - String Allowed values: AssertionOnly, MessageAndAssertion, MessageOnly Specifies the response signature or signatures that the relying party expects. .PARAMETER SignatureAlgorithm Write - String Allowed values: http://www.w3.org/2000/09/xmldsig#rsa-sha1, http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 Specifies the signature algorithm that the relying party uses for signing and verification. .PARAMETER SignedSamlRequestsRequired Write - Boolean Indicates whether the Federation Service requires signed SAML protocol requests from the relying party. If you specify a value of True, the Federation Service rejects unsigned SAML protocol requests. .PARAMETER SigningCertificateRevocationCheck Write - String Allowed values: None, CheckEndCert, CheckEndCertCacheOnly, CheckChain, CheckChainCacheOnly, CheckChainExcludeRoot, CheckChainExcludeRootCacheOnly Specifies the type of certificate validation that occur when signatures on requests from the relying party are verified. .PARAMETER TokenLifetime Write - Sint32 Specifies the duration, in minutes, for which the claims that are issued to the relying party are valid. .PARAMETER WSFedEndpoint Write - String Specifies the WS-Federation Passive URL for this relying party. .PARAMETER AllowedClientTypes Write - String Allowed values: None, Public, Confidential Specifies allowed client types. .PARAMETER AlwaysRequireAuthentication Write - Boolean Indicates to always require authentication. .PARAMETER RequestMFAFromClaimsProviders Write - Boolean Indicates whether to use the request MFA from claims providers option. .PARAMETER AllowedAuthenticationClassReferences Write - String Specifies an array of allow authentication class references. .PARAMETER IssueOAuthRefreshTokensTo Write - String Allowed values: NoDevice, WorkplaceJoinedDevices, AllDevices Specifies the refresh token issuance device types. .PARAMETER RefreshTokenProtectionEnabled Write - Boolean Indicates whether refresh token protection is enabled. .PARAMETER SamlEndpoint Write - String Specifies an array of Security Assertion Markup Language (SAML) protocol endpoints for this relying party. .PARAMETER Ensure Write - String Allowed values: Present, Absent Specifies whether to remove or add the relying party trust. .EXAMPLE 1 This configuration will add a relying party trust named Fabrikam for federation using the federation metadata document published at the specified URL. Configuration AdfsRelyingPartyTrust_Metadata_Config { Import-DscResource -Module AdfsDsc Node localhost { AdfsRelyingPartyTrust OwaInternal { Name = 'Fabrikam' MetadataURL = 'https://fabrikam.com/federationmetadata/2007-06/federationmetadata.xml' } } } .EXAMPLE 2 This configuration will add a relying party trust with an LDAP Claims issuance transform rule in Active Directory Federation Services (AD FS). Configuration AdfsRelyingPartyTrust_LdapClaims_IssuanceTransformRules_Config { Import-DscResource -Module AdfsDsc Node localhost { AdfsRelyingPartyTrust WebApp1 { Name = 'WebApp1' Enabled = $true Notes = 'This is a trust for https://webapp1.fabrikam.com' WSFedEndpoint = 'https://webapp1.fabrikam.com' Identifier = 'https://webapp1.fabrikam.com' AccessControlPolicyName = 'Permit Everyone' IssuanceTransformRules = @( MSFT_AdfsIssuanceTransformRule { TemplateName = 'LdapClaims' Name = 'WebApp1 Ldap Claims' AttributeStore = 'Active Directory' LdapMapping = @( MSFT_AdfsLdapMapping { LdapAttribute = 'objectSID' OutgoingClaimType = 'http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid' } MSFT_AdfsLdapMapping { LdapAttribute = 'userPrincipalName' OutgoingClaimType = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn' } ) } ) } } } .EXAMPLE 3 This configuration will add a relying party trust with a Group Claims issuance transform rule in Active Directory Federation Services (AD FS). Configuration AdfsRelyingPartyTrust_EmitGroupClaims_IssuanceTransformRules_Config { Import-DscResource -Module AdfsDsc Node localhost { AdfsRelyingPartyTrust WebApp1 { Name = 'WebApp1' Enabled = $true Notes = 'This is a trust for https://webapp1.fabrikam.com' WSFedEndpoint = 'https://webapp1.fabrikam.com' Identifier = 'https://webapp1.fabrikam.com' AccessControlPolicyName = 'Permit Everyone' IssuanceTransformRules = @( MSFT_AdfsIssuanceTransformRule { TemplateName = 'EmitGroupClaims' Name = 'App1 User Role Claim' GroupName = 'App1 Users' OutgoingClaimType = 'http://schemas.microsoft.com/ws/2008/06/identity/claims/role' OutgoingClaimValue = 'User' } ) } } } .EXAMPLE 4 This configuration will add a relying party trust with a custom claims issuance transform rule in Active Directory Federation Services (AD FS). Configuration AdfsRelyingPartyTrust_CustomClaims_IssuanceTransformRules_Config { Import-DscResource -Module AdfsDsc Node localhost { AdfsRelyingPartyTrust WebApp1 { Name = 'WebApp1' Enabled = $true Notes = 'This is a trust for https://webapp1.fabrikam.com' WSFedEndpoint = 'https://webapp1.fabrikam.com' Identifier = 'https://webapp1.fabrikam.com' AccessControlPolicyName = 'Permit Everyone' IssuanceTransformRules = @( MSFT_AdfsIssuanceTransformRule { TemplateName = 'CustomClaims' Name = 'App1 Custom Claim' CustomRule = 'TBC' } ) } } } .EXAMPLE 5 This configuration will add a relying party trust with access control policy parameters in Active Directory Federation Services (AD FS). Configuration AdfsRelyingPArtyTrust_AccessControlPolicyParameters_Config { param() Import-DscResource -ModuleName AdfsDsc Node localhost { AdfsRelyingPartyTrust WebApp1 { Name = 'WebApp1' Enabled = $true Notes = 'This is a trust for https://webapp1.fabrikam.com' WSFedEndpoint = 'https://webapp1.fabrikam.com' Identifier = 'https://webapp1.fabrikam.com' AccessControlPolicyName = 'Permit specific group' AccessControlPolicyParameters = MSFT_AdfsAccessControlPolicyParameters { GroupParameter = @( 'CONTOSO\AppGroup1 Users' 'CONTOSO\AppGroup1 Admins' ) } } } } |