Pages

September 20, 2015

Customizing the AD FS Sign-In Page



If you are not happy with the default design of the AD FS Sign-In page you can use the commands below to update the page. Below are a few of the commands that i have used to customize the page but other options are available.

Default Sign-in Page:


Change Company Name

You can change the company name with the following powershell command:

Set-AdfsGlobalWebContent -CompanyName "New Company Name"

Change Company Logo

When changing the company logo Microsoft recommends the dimensions for the logo to be 260x35 @96 dpi with a file size no larger than 10KB.

Set-AdfsWebTheme -TargetName default -Logo @{path"c:\images\logo.png"}


Change Graphic on the left

To change the image on the left you can use the following powershell cmdlet. Microsoft recommends that the illustration be 1420x1080 @96 dpi and no larger than 200KB.

Set-AdfsWebTheme -TargetName default -Illustration @{path="c:\images\illustration.png"}

Add a description to sign-in page

You can use the following powershell command to change the description on the sign in page. The text for "signInPageDescriptionText" paramter supports html tags.

Set-AdfsGlobalWebContent -SignInPageDescriptionText "For assistance please visit our support site here.
"





Additional Resources:
https://technet.microsoft.com/en-us/library/dn280950.aspx












September 8, 2015

SAML Authentication with Jive 8.0 and Active Directory Federation Services 2.0




Overview:
This document outlines the process required to configure Jive 8.0 to work with Active Directory Federation Services 2.0.
This document only outlines how to setup a new installation of Jive to authenticate using ADFS it does not outline how to migrate from
an alternate authentication source to ADFS.


Assumptions:
1. Active Directory Federation Services 2.0 on Windows 2012 R2 is installed
2. AD FS will be using Active Directory to authenticate users.
3. Jive 8.0 (Jive 7 & 6 *should* work also) is installed
4. Your Jive instance must be using https for this to work

Configuring ADFS

1. Open AD FS console and expand trust relationships and right click on the Relying party trusts and select Add relying party trust
2. Click start and on the next screen enter the URL for your Jive SP Metadata in the first section. By default the URL is "https:///saml/metadata"


3. Type a displayname to identify this trust. Click Next
4. On the multi-factor authentication step makre sure "I do not want to configure multifactor authentication settings....." is selected and click next.


5. Accept the default option "Permit all users to access this relying party" and click next

July 6, 2015

Finding Expensive LDAP queries in LDS or Active Directory



Overview

This is a quick guide on how to find expensive & inefficient LDAP queries running against Active Directory or Lightweight Directory Services.


Steps

1. While the CPU is running high change the following registry key to "5"
  1. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Diagnostics\15 Field Engineering  

2. Update or create the following registry values to the desired threshold in miliseconds. (Data Type Should be DWORD) The values below are the default values.

  1. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\Expensive Search Results Threshold  = 10,000  
  2. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\Inefficient Search Results Threshold = 1,000  
  3. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\Search Time Threshold (msecs) = 30,000  

3. Let that run for a period of time during the high CPU issues.
4. Open the Directory Services Log
5. The events with 1644 as the eventID should give you an idea of where the traffic is coming from and what queries are being ran against the server.

Note: Dont forget to change the "15 Field Engineering" value back to 0 when you are done troubleshooting.