ADFS 4.0 manages OpenID Connect / OAuth connections via the "Application Groups" folder.
There are three kinds:
- Native application
- Server application
- Web API
which leads to the following combinations:
- Native application accessing web API
- Server application accessing Web API
Plus the odd one out:
- Web browser accessing web application
The PowerShell cmdlets split into three separate commands:
- Get-AdfsNativeClientApplication
- Get-AdfsServerApplication
- Get-AdfsWebApiApplication
So although you can create an application with a web API in one pass through the wizard, the separate components need to be accessed via PowerShell.
Examples:
Get-AdfsNativeClientApplication
Name : MyApp - Native application
Identifier : b2...27
ApplicationGroupIdentifier : MyApp
Description :
Enabled : True
RedirectUri : {https://blah}
Get-AdfsServerApplication
ADUserPrincipalName :
ClientSecret : ********
JWTSigningCertificateRevocationCheck : None
JWTSigningKeys : {}
JWKSUri :
Name : My server application
Identifier : 8e...44
ApplicationGroupIdentifier : MyApp
Description :
Enabled : True
RedirectUri : {https://blah}
Get-AdfsWebApiApplication
Name : My Web API
Identifier : {https://blah/webapi}
AccessControlPolicyName : Permit everyone
AccessControlPolicyParameters :
AdditionalAuthenticationRules :
AllowedAuthenticationClassReferences : {}
AllowedClientTypes : Public, Confidential
ApplicationGroupIdentifier : MyApp
ApplicationGroupId : 12...56
AlwaysRequireAuthentication : False
ClaimsProviderName : {}
DelegationAuthorizationRules :
Enabled : True
ImpersonationAuthorizationRules :
IssuanceAuthorizationRules :
IssueOAuthRefreshTokensTo : AllDevices
IssuanceTransformRules : @RuleName = "All"
c:[]
=> issue(claim = c);
NotBeforeSkew : 0
Description :
PublishedThroughProxy : False
RefreshTokenProtectionEnabled : False
RequestMFAFromClaimsProviders : False
ResultantPolicy : RequireFreshAuthentication:False
IssuanceAuthorizationRules:
{
Permit everyone
}
TokenLifetime : 0
Plus we have the legacy cmdlets from ADFS 3.0:
Get-AdfsClient
RedirectUri : {ms-appx-web://Microsoft.AAD.BrokerPlugin}
Name : Windows Logon Client
Description : Client for Microsoft Windows Logon
ClientId : 38...93b
BuiltIn : True
Enabled : True
ClientType : Public
ADUserPrincipalName :
ClientSecret :
JWTSigningCertificateRevocationCheck : None
JWTSigningKeys : {}
JWKSUri :
Just remember that the clientID is auto-generated when you create one of these entries and the secret key can only be viewed once in the wizard during creation.
Plus there was this question over on the forum around scope:
In an ADFS Application Group, add Client Application/Permitted Scope to Web API with PowerShell
Grant-AdfsApplicationPermission -ClientRoleIdentifier $clientAppIdGuid
-ServerRoleIdentifier $relyingPartyIdentifier -ScopeNames
$theScopesYouWantAssignedTo
And remember you can get all the commands by:
get-command *adfsclient*
CommandType Name Version Source
----------- ---- ------- ------
Cmdlet Add-AdfsClient 1.0.0.0 ADFS
Cmdlet Disable-AdfsClient 1.0.0.0 ADFS
Cmdlet Enable-AdfsClient 1.0.0.0 ADFS
Cmdlet Get-AdfsClient 1.0.0.0 ADFS
Cmdlet Remove-AdfsClient 1.0.0.0 ADFS
Cmdlet Set-AdfsClient 1.0.0.0 ADFS
get-command *adfsnativeclient*
CommandType Name Version Source
----------- ---- ------- ------
Cmdlet Add-AdfsNativeClientApplication 1.0.0.0 ADFS
Cmdlet Get-AdfsNativeClientApplication 1.0.0.0 ADFS
Cmdlet Remove-AdfsNativeClientApplication 1.0.0.0 ADFS
Cmdlet Set-AdfsNativeClientApplication 1.0.0.0 ADFS
get-command *adfsserver*
CommandType Name Version Source
----------- ---- ------- ------
Cmdlet Add-AdfsServerApplication 1.0.0.0 ADFS
Cmdlet Get-AdfsServerApplication 1.0.0.0 ADFS
Cmdlet Remove-AdfsServerApplication 1.0.0.0 ADFS
Cmdlet Set-AdfsServerApplication 1.0.0.0 ADFS
get-command *adfswebapi*
CommandType Name Version Source
----------- ---- ------- ------
Cmdlet Add-AdfsWebApiApplication 1.0.0.0 ADFS
Cmdlet Get-AdfsWebApiApplication 1.0.0.0 ADFS
Cmdlet Remove-AdfsWebApiApplication 1.0.0.0 ADFS
Cmdlet Set-AdfsWebApiApplication 1.0.0.0 ADFS
get-command *adfsapplication*
CommandType Name Version Source
----------- ---- ------- ------
Cmdlet Disable-AdfsApplicationGroup 1.0.0.0 ADFS
Cmdlet Enable-AdfsApplicationGroup 1.0.0.0 ADFS
Cmdlet Get-AdfsApplicationGroup 1.0.0.0 ADFS
Cmdlet Get-AdfsApplicationPermission 1.0.0.0 ADFS
Cmdlet Grant-AdfsApplicationPermission 1.0.0.0 ADFS
Cmdlet New-AdfsApplicationGroup 1.0.0.0 ADFS
Cmdlet Remove-AdfsApplicationGroup 1.0.0.0 ADFS
Cmdlet Revoke-AdfsApplicationPermission 1.0.0.0 ADFS
Cmdlet Set-AdfsApplicationGroup 1.0.0.0 ADFS
Cmdlet Set-AdfsApplicationPermission 1.0.0.0 ADFS
Enjoy!
