I am a developer trying to understand authentication with ADFS (2012 R2), so I am trying to setup an ADFS lab.
I have found 2 guides:
- doc1 – http://technet.microsoft.com/en-us/library/dn280939.aspx
- doc2 – http://blogs.technet.com/b/askpfeplat/archive/2013/12/09/how-to-build-your-adfs-lab-on-server-2012-part-1.aspx
Doc1 starts with creating a gSMA account, however Doc2 says "The ADFS configuration wizard will automatically configure the correct Service Principal Names (SPN) on this service account so don’t worry about this configuring the SPN."
Which path should I take?
If you think I should create the gSMA account, can you help me understand what values I should provide in my lab?
They are using
New-ADServiceAccount FsGmsa -DNSHostName adfs1.contoso.com -ServicePrincipalNames http/adfs1.contoso.com
My server is called server1.mydomain.local. Should my new gSMA command look like this?:
New-ADServiceAccount FsGmsa -DNSHostName server1.mydomain.local -ServicePrincipalNames http/server1.mydomain.local
I am specifically asking about the "ServicePrincipalNames" attribute because doc2 says to "Ensure that the physical computer name of any of the ADFS servers in the farm don’t match the ADFS service name"
Best Answer
You can either let the ADFS wizard make necessary configuration for gMSA account
or
you can pre-create your gMSA account with correct SPN (which is your adfs Service name). Same name needs to be also at certificate subject and SAN fields.
-Sami