Block access to all relying parties

Alex Negroiu 21 Reputation points
2020-07-22T10:52:59.413+00:00

Hi,

I'm curious if there is any way of blocking access to all relying parties on an ADFS instance (Windows Server 2012 R2), by denying access based on an incoming claim.
I know that according to the documentation a deny rule can be implemented based on a specific attribute (e.g. user is member to a specific group). However that needs to be configured on each relying party.
I would be interested in finding if there is a mechanism through which this deny rule can be applied once globally and it will cover both existing relying parties and new ones that might show up in the future.
The best that I can think of is creating a PowerShell script that will run inside a scheduled task (let's say daily), it checks all relying parties for the existence of this rule (including newly added RPs), and if the rule is not there it will add it to the RP.
Is there a better approach than the scheduled PowerShell script?

Thanks.

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,259 questions
0 comments
Accepted answer
  1. Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee
    2020-07-23T03:06:18.56+00:00

    It has to be done per RP. You could create a group, issue a deny claim if a user is a member of that group and set that on all RP. You don't need a schedule task, you can just add or remove user from that group.

    Or, you could add the user account to the local policy Deny access to this computer from the network and the user cannot use ADFS all together :)

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.