Yesterday Microsoft released Update Rollup 3 for Active Directory Federation Services (AD FS) 2.0.
This update includes five (5) hotfixes, summarised below. The update is cumulative which means it contains all fixes and features in the previous two updates: update rollup 1 and update rollup 2.
- AD FS 2.0 does not issue an ActAs token for a relying party who is using a Security Assertion Markup Language (SAML) 2.0 bootstrap token.
- AD FS 2.0 update rollup 2 introduced strict Uniform Resource Identifier (URI) checking. When AD FS 2.0 acts as a federation provider and trusts an identity provider whose identifier is not an URI, the response that is returned from the identity provider is rejected by AD FS 2.0. The validation fails because AD FS 2.0 tries to validate the value of the identity provider’s identifier. This behaviour breaks previously functioning AD FS 2.0 deployments in which identity providers use non-URI identifiers. AD FS 2.0 update rollup 3 removes this URI checking.
- AD FS 2.0 does not allow multiple relying party trusts to use the same signing certificate for SAML request.
- Note that a post-installation/upgrade configuration task is required for this change to become effective. The steps are described here.
- Performance of AD FS 2.0 needs improvement when HSM is used for storing private key of token signing/encryption certificate.
- AD FS 2.0 update rollup 1 introduces the Congestion Avoidance Algorithm. If you accidentally disable the Congestion Avoidance Algorithm by changing the configuration, a handle leak occurs on an AD FS 2.0 federation server proxy every time that the federation server proxy processes a request. AD FS 2.0 update rollup 3 removes the setting that enables you to disable Congestion Avoidance Algorithm by changing the configuration. You can fine tune the Congestion Avoidance Algorithm by adjusting the latencyThresholdInMsec and minCongestionWindowSize settings.
