1

We use a proxy service by zScaler. This has been setup so that there is an ADFS server between us and zScaler that authenticates the users and allows them access to the internet. This has been working all fine and dandy until sometime in the last few months (possibly 6). Normal users are able to authenticate correctly still and receive their internet cookie. Members of Domain Admins however do not. A support call with zScaler has ended with them suggesting we need to contact Microsoft and open a support call with them. Fair enough, but thought I would see if any one here has any thoughts?

We have tried removing a user from domain admins, changing the OU their user account resides in, redeplying the ADFS server from scratch (needed in the end to rule out red herring errors and due to another admin not having comiled stringent documentation). No error is generated when I try and login but the browser goes in to an endless loop trying to authenticate.

The only potential breakthrough we may have had is disabling SAML and setting Forms as the authentication method. With the login prompt then presented we can enter the credentials but the page refreshes and does not process the request. From the server side I can see an Audit Failure (4776) but this seems to refer to LM levels in the domain which do not change per user account.

I am not an expert with ADFS 2.0 by any stretch of the imagination and the only use we have within our company is for the proxy. This means that skills and knowledge are somewhat thin on the ground.

I will leave it at this as my message already seems quite rambling but I would be grateful of some thoughts if anyone has any as this is a bit of a head scratcher.

UPDATE:

Looks like there is something promising in this KB:

https://support.microsoft.com/kb/2896713/en-us#appliesto

Will look to test over the maintenance window at the weekend but fingers crossed.

  • There isn't quite enough detail to give an answer. Whats the end user experience when it fails? Do you get an error from ZScaler or AD FS? AD FS and Zscaler settings appear to be OK as normal users work. You need to know what ZScaler is expecting as claims to allow using it. What are the claims sent when a domain admin tries to logon using AD FS. Do you have authorization rules on AD FS denying domain admins? There are multiple possibilities here to give a definite answer. – maweeras May 05 '14 at 16:51

1 Answers1

0

So it turns out this KB was the root cause of the problem:

http://support.microsoft.com/kb/2843638

If a user is a member of a large number of accounts then the authentication will go in to a loop and never complete. We had previoiusly had this issue with large Kerberos ticket sizes in our organization. That coupled with an expansion that generated a load more groups in AD meant that our Domain Admins members were now tripping the "large number of groups" limit. Applying the following hot fix:

https://support.microsoft.com/kb/2896713/en-us#appliesto

has now resolved the issue. Hope this is useful to anyone else who stumbles across this problem with ADFS.