You are currently running ADFS 2012 R2 and you are planning on upgrading (yes, you can upgrade!) to ADFS 2016. Your Home Realm Discovery (HRD) page is looking similar to the one in figure 1, meaning that the AD CP trust is listed at the top and that it inherits the Display Name of the federation service. So far so good , right?
Figure 1: A Home Realm Discovery Web Page In ADFS 2012 R2 Or ADFS 2016 When At ADFS 2012 R2 Farm Level
–
After adding ADFS 2016 servers and removing the ADFS 2012 R2 servers, it is time to increase the farm level to the highest farm level possible.
–
You “throw the switch” and suddenly your HRD page looks similar to the one as displayed in figure 2. Damn!
Figure 2: A Home Realm Discovery Web Page In ADFS 2016 When At, At Least ADFS 2016 Farm Level
–
From a user perspective, that can be quite some impact as user to not expect “their default selection” to have moved to the bottom. Worse yet, the users might not even recognize it because the trust display name does not inherit the display name of the federation service anymore. It just shows as “Active Directory”, which is a technical name. You might think in changing the display name of the “Active Directory” CP trust to match whatever you need. Let me save you the trouble of trying that, because, it is not allowed to change much including the display name.
So, one simple change (farm level increase) results in an unfortunate functional impact for users.
What can you do about this? The solution to this problem is to implement some extra javascript code in the ONLOAD.JS.
To make sure your current web theme is not broken while making this change, make sure to first create a new web theme and implement the changes in that new web theme. So let’s get started!
–
Retrieve the name of your CURRENT web theme
Get-AdfsWebConfig
In the property called “ActiveThemeName” you will find the name of the current theme that is active and in use by everyone.
–
Make a copy of that theme and give the copy a new name:
New-AdfsWebTheme -Name <New WebTheme Name> -SourceName <Current Active WebTheme Name>
–
Export the new web theme to be able to edit it:
MD <Path To Export The Theme To>
Export-AdfsWebTheme -Name <New WebTheme Name> -DirectoryPath <Path To Export The Theme To>
–
Open the ONLOAD.JS file
NOTEPAD "<Path To Export The Theme To>\script\onload.js"
–
Edit the ONLOAD.JS file by adding a piece of javascript code at the end of it. It will put the AD CP trust at the top again and it will rename it to the display name of your choosing. It has been tested with the following browsers: IE, Edge, Chrome, Firefox, Safari.
REMARK: Make sure to follow guidelines as available in https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/advanced-customization-of-ad-fs-sign-in-pages
The javascript code is available at: https://github.com/microsoft/adfsWebCustomization/tree/master/communityCustomizations/RenameAndReorderADCPTrust
–
Save the ONLOAD.JS file
–
Import the new ONLOAD.JS into the new web theme
Set-AdfsWebTheme -TargetName <New WebTheme Name> -AdditionalFileResource @{Uri=’/adfs/portal/script/onload.js’;path="<Path To Export The Theme To>\script\onload.js"}
–
Now it is time to activate the new web theme and check it has been activated
Set-AdfsWebConfig -ActiveThemeName <New WebTheme Name>
Get-AdfsWebConfig
–
Now make sure to clear your cookies, and navigate to an application connected to ADFS for which more than one CP trust is allowed to use. In that case, assuming you have cleared your cookies, the HRD page should appear and it should again be similar to what you see in figure 1.
–
If you need to revert back to your previous current web theme, you new to activate it as such and check it has been activated
Set-AdfsWebConfig -ActiveThemeName <Current Active WebTheme Name>
Get-AdfsWebConfig
–
PS: make sure to test this first in a test environment!
–
Cheers,
Jorge
————————————————————————————————————————————————————-
This posting is provided "AS IS" with no warranties and confers no rights!
Always evaluate/test everything yourself first before using/implementing this in production!
This is today’s opinion/technology, it might be different tomorrow and will definitely be different in 10 years!
DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/
————————————————————————————————————————————————————-
########################### Jorge’s Quest For Knowledge ##########################
#################### http://JorgeQuestForKnowledge.wordpress.com/ ###################
————————————————————————————————————————————————————-