How to Remove AD FS Proxy Servers and Maintain Metadata Access
Question details
The user needs to ensure that external relying parties can continue to access identity provider metadata after AD FS proxy servers have been removed.
- Product
- Active Directory Federation Services (AD FS)
- Device & OS
- not provided
- Scenario
- Decommissioning or removing proxy servers in a federation server farm while trying to maintain external federation connectivity.
- Observed behavior
- External relying parties lose the ability to access identity provider metadata because the proxy servers facilitating the external connection are no longer available.
Before making structural changes to your federation architecture, ensure your external DNS is updated to route traffic correctly and that your firewall rules are adjusted to allow relying parties to reach the required endpoints.
Configure Federation Servers to Publish Metadata Directly
Configure each federation server in your farm to publish its own federation metadata, allowing relying parties to access it without relying on a proxy server.
In a standard AD FS deployment, proxy servers act as intermediaries that publish metadata to external parties. Once removed, you must explicitly configure your internal federation servers (or load balancer) to handle these external metadata requests.
This approach requires re-routing external federation traffic directly to your internal farm, which changes your network security posture.
Log in to your primary AD FS federation server as an Administrator and open the AD FS Management console.
Navigate to Services > Endpoints in the console. Ensure that the Federation Metadata endpoint (typically /FederationMetadata/2007-06/FederationMetadata.xml) is enabled.
Modify your external DNS records for the federation service name to point directly to the public IP address of your internal federation servers or your external-facing load balancer.
Configure your perimeter firewalls to allow inbound HTTPS (port 443) traffic from external relying parties to your federation servers, effectively replacing the proxy routing.
Seek Advanced Assistance via Microsoft Q&A
Consult Microsoft's official channels for advanced troubleshooting and architectural guidance regarding AD FS proxy removal.
Streamline Your IT Documentation with WPS Office
While managing AD FS and Windows Server architectures requires specialized administrative tools, documenting these complex network deployments is easier with WPS Office. It provides a lightweight, highly compatible, and free alternative to Microsoft Office for writing deployment guides, tracking server logs, and creating network diagrams.
- 1. Download the Software: Visit the official WPS Office website to download the free, lightweight installation package for your operating system.
- 2. Open Existing IT Documents: Launch WPS Office and seamlessly open your existing Microsoft Office deployment guides and server tracking spreadsheets.
- 3. Edit and Export: Utilize the intuitive tabbed interface to update your network documentation and easily export it to PDF for secure sharing with your team.
Frequently Asked Questions
Why do relying parties fail to access metadata after removing AD FS proxies?
Relying parties continuously look for metadata at the configured federation service endpoint. If external DNS still points to the decommissioned proxy IP, or if the internal servers aren't configured to publish metadata to external networks, the connection will time out.
Can I publish AD FS metadata without a proxy server?
Yes, in a federation server farm, each federation server can be configured to publish its own metadata directly. However, this requires allowing external inbound traffic to reach your internal servers or load balancer, which bypasses traditional proxy isolation.
Is it secure to expose AD FS federation servers directly to the internet?
Microsoft generally recommends using Web Application Proxies (WAP) or AD FS proxy servers to insulate internal servers from direct internet exposure. If you choose to remove proxies, you must implement stringent network firewalls, load balancing rules, and access policies to maintain security.
