ADFS ERROR : ADMIN0017 ADFS ERROR : An error occured during an attempt to access the ADFS Configuration Database:

ADFS ERROR :  ADMIN0017
ADFS ERROR :  An error occured during an attempt to access the ADFS Configuration Database:

ADFS ERROR :  An error occured during an attempt to access the ADFS Configuration Database:
Error Message: ADMIN0017: An Exception Occured while Connecting to the configuration Service. the configuration service URL 'net.tcp://localhost:1500/policy' may be incorrect or the ADFS Windows service is not running.

I came across this error message in my lab set up as today as I was trying to add a new Relying party trust.

IDP page is also not working, there were no options in ADFS Consile in the left hand side.

I just restarted the ADFS service,

 IDP started working and the options to came up.

if this doesnt work, for WID service in services and ADFS service re-enter the password for te service account.

please comment if this helped you as well!

Auto Cert Rollover in ADFS and setting the new token signing as primary and changing the old one as secondary | Renew federation certificates for Office 365 and Azure Active Directory

Renew federation certificates for Office 365 and Azure Active Directory

Auto Cert Rollover in ADFS and setting the new token signing as primary and changing the old one as secondary 

If you get a token signing certificate when the old certificate is expiring, the new certificate will sitting only as "secondary" until the promotion threshold is met .



you cannot change the cert as Primary. It will be grayed out.

Step 1: Check the AutoCertificateRollover state

get into the Primary ADFS server


run   Get-Adfsproperties in PowerShell with elevated rights.


check if autocertificateRollover is set to "true"

here the threshold is 5 days so the new certificate will become as Primary 5 days before the expiry of the original certificate.

Step 2: Confirm that AD FS and Azure AD are in sync

Install-Module MSOnline
Connect to Azure AD using the MSOnline PowerShell-Module.Import-Module MSOnlineConnect-MsolService
Check the certificates configured in AD FS and Azure AD trust properties for the specified domain.Get-MsolFederationProperty -DomainName <domain.name> | FL Source, TokenSigningCertificate
If the thumbprints in both the outputs match, your certificates are in sync with Azure AD.

if not run Update-MSOLFederatedDomain –DomainName <domain>

Renew the token signing certificate automatically (recommended) 

You don't need to perform any manual steps if both of the following are true:You have deployed Web Application Proxy, which can enable access to the federation metadata from the extranet.You are using the AD FS default configuration (AutoCertificateRollover is enabled).Check the following to confirm that the certificate can be automatically updated.

1. The AD FS property AutoCertificateRollover must be set to True. This indicates that AD FS will automatically generate new token signing and token decryption certificates, before the old ones expire.

2. The AD FS federation metadata is publicly accessible. Check that your federation metadata is publicly accessible by navigating to the following URL from a computer on the public internet (off of the corporate network):https://(your_FS_name)/federationmetadata/2007-06/federationmetadata.xmlwhere (your_FS_name)is replaced with the federation service host name your organization uses, such as fs.contoso.com. If you are able to verify both of these settings successfully, you do not have to do anything else.

Example: https://fs.contoso.com/federationmetadata/2007-06/federationmetadata.xml

REFER:


https://blogs.msdn.microsoft.com/vilath/2015/09/02/how-to-update-certificates-for-ad-fs-3-0/

Getting error in ADFS proxy 2.0 "Encountered error during federation passive request"

Some customers who are using 2008 server for ADFs proxy may sometime get errors
  "Encountered error during federation passive request"

This usually happens when they change the certificate which is about to expire.

Usually for this kind of issue where the ADFS service and metadata when not accessible extenally we check for certificate bindings

we will be going to PowerShell  with admin rights

run
get-Webapplicationproxysslcertificate
compare the thumbprint with ADFS

but in 2008 R2 we don't have this option to run PS command

so run the ADFS proxy 2.0 wizard that will be fixing the most of the issues.

how to find the ADFS Service name ADFS 2.0 or 3.0

This small article talks about finding the ADFS Service name

simply open the powershell with elevated rights in the ADFS server

run the command " Get-Adfsproperties"

in the result check for the host name, you can find something like  "adfs.fabrikam.com"


In the GUI mode open the adfs  mmc console and click on ADFS in the left.

So that in the right you can find an option called " Edit Federation Service Properties"

when you click on that you can find the Federation Service name