Migrate to another ADFS server

[BartHermans007]

I have already a working ADFSMFA cluster server while using AD as storage. So, no SQL server is used.
If I want to install a new ADFS server on the same AD infrastructure (using the same domain controllers), how can I get the same OTP codes for each user? I assume that I need to have a unique key that is used on the working ADFSMFA server.

I have seen there's an export possibility with the command "Export-MFASystemConfiguration". Is that the way to go?

Regards.

[redhook62]

Hi,

If with the first ADFS server you saved the keys in your ADDS, I don't see any problems, those keys will still be valid.
The secondary server will be able to access all the options stored in your ADDS for all users.
You don't need to export the configuration.
Please refer to the Wiki for adding a new server to your ADFS Farm.
All of our tests (2019/2016/2012r2) are made with a cluster (2 servers) with ADDS or SQL.
However, if you have access or rights issues, please refer to the Wiki section on installing and adding a new ADFS server.

https://github.com/neos-sdi/adfsmfa/wiki/01-Installation#installation
https://github.com/neos-sdi/adfsmfa/wiki/01-Installation#add-an-adfs-server

regards

[BartHermans007]

Hoi Redhook,
Thank you for your reply. I must redefine my question: I don't want to add a new cluster member in the existing farm, I want a new ADFS farm with another federation name, but want to keep using the key's that are stored in AD.

Regards.

[redhook62]

of course, this will work fine, cla can (but not recommended) work with multiple ADFS farms, provided it is the same ADDS domain used

[BartHermans007]

Hoi Redhook
It works now, but not out-of-the-box. I have to do an export of the configuration on the 'original' ADFSMFA server.
In the exported XML there's a key in "KeysConfig KeyGenerator" called XORSecret. You need to take a copy of that key.
On the 'new' ADFSMFA server I first exported the configuration and changed the XORSecret value (with the key that I copied).
Then I imported the XML again in the 'new' ADFSMFA server.
After that, the Secret Key's of the users are on both servers the same.
A reboot of the server was also necessary to let it work.

Regards.

[redhook62]

There is absolutely no need to restart the servers, at worst you have to restart the MFA Service.
it seems logical after an installation, and yes it is a security appliance, and especially not a "playstore" app....
As for the XOR key, you are asked in the documentation to fill it in during installation, because user keys are affected by this parameter.

regards

[BartHermans007]

Hoi Redhook.
I appreciate your support very much. Thank you.
I'll check the documentation where to fill in a XOR key during the installation/configuration.
I know that it is not a "playstore" app, and it fulfills exactly what my company needs.

Thank you for all your effort.

Regards.

[redhook62]

mark as answer

[PsySuck]

Hi.
@redhook62 can be migration permofrm if rsamasterkey was deployed?
We want migrate to the new farm but kept register TOTP key. Is it possibe? If yes. How it can be done?

[redhook62]

Hi @PsySuck

It's not very clear for me.
I think as stated above you need to export the current configuration to your new platform.
If you are talking about the common security certificate to encrypt the TOTP keys, you must export this certificate (with Windows certificate management) and redeploy it on your new servers.

regards

[PsySuck]

Yes, i am talking common security certificate to encrypt the TOTP keys.
I can't understand which certificate used for this. I am using GMSA for adfs and adfsmfa.

[redhook62]

The certificate Name is : MFA RSA Key + Datetime creation
You can verify with the thumprint present in the configuration

Simple !

Regards

[PsySuck]

I did't find any info about cert in configuration. Also i checked exported configuration. This is reason why i asking.

[redhook62]

Hi,

The certificate must be present in Windows Certificate Management for the local computer. get help if you can't find it.

On the other hand, if you use one RSA certificate per user, each certificate is stored either in ADDS or in the SQL Server database depending on your configuration.

You can check all this in the console: Security / Asymmetric Keys RSA

regards

[PsySuck]

On the other hand, if you use one RSA certificate per user, each certificate is stored either in ADDS or in the SQL Server database depending on your configuration.

You are right. Thanks. I didn't read the documentation correctly - I thought there was also a master certificate - regardless of the settings. That is, I only need to enter the correct XorSecret and another farm will be able to see the data?

[redhook62]

Yes

Yes, it is imperative in your case

• Transfer the master certificates to the new servers.
• Use the same XORSecret key for your new platform.

Are you on the same ADDS domain?
Do you use for ADDS or SQL storage?

[PsySuck]

Are you on the same ADDS domain? Yes.
ADDS as storage.

[redhook62]

Ok

So there shouldn't be any issues here.
Also, the new and old platform should continue to work...

[PsySuck]

@BartHermans007 @redhook62
Thanks. Everything works.

[redhook62]

Great !