> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/powershell-universal/da/sikkerhed/enterprise-security/ws-federation.md).

# WS-Federation

Konfigurer WS-Federation-godkendelse i PowerShell Universal med ADFS eller Azure Active Directory, herunder opsætning af relying party-tillid.

{% hint style="info" %}
WS-Federation kræver en [licens](https://store.devolutions.net/package#psu).
{% endhint %}

WS-Federation understøtter både Active Directory Federation Services og Azure Active Directory.

De skal først konfigurere ADFS eller AzureAD til at understøtte Universal.

## Konfiguration af ADFS til Universal <a href="#configuring-adfs-for-universal-dashboard" id="configuring-adfs-for-universal-dashboard"></a>

### Tjenesteindstillinger <a href="#service-settings" id="service-settings"></a>

Først skal De indsamle Federation Service Properties fra ADFS. Åbn AD FS-appen (Microsoft.IdentityServer.msc). Klik derefter på Service og derefter på Edit Federation Service Properties.

Dette åbner en dialogboks med værdierne for Deres ADFS-tjeneste. De skal bruge disse værdier til konfiguration af PowerShell Universal.

### Relying parties <a href="#relying-parties" id="relying-parties"></a>

Hvis De ikke har nogen Reply Party Trusts konfigureret, skal De klikke på Add Replying Party Trust. Vælg Claims aware.

Vælg Enter data about the relying party manually.

Angiv et navn til den relying party.

Aktivér WS-Federation Passive-protokollen. Angiv URL'en til PowerShell Universal-serveren med en afsluttende skråstreg.

Angiv URL'en til Deres PowerShell Universal-server.

Når De har afsluttet Deres Replying Party Trust-konfiguration, skal De opsætte en Claim Issuance Policy. Opret en Issuance Transform Rule, der sender mindst Name og Name ID til Universal.

De kan konfigurere yderligere claims, som De gerne vil bruge, hvis De bruger politikker i Universal.

### Fejlfinding

MSIS7065: There are no registered protocol handlers on path /adfs/ls to process the incoming request.

Dette problem kan skyldes, at siden IDP Initiated Sign On er deaktiveret. Dette er standardindstillingen. Kør følgende kommando fra en administrativ konsol.

{% code collapsedlinecount="10" %}

```powershell
 Set-AdfsProperties -EnableIdPInitiatedSignonPage $true
```

{% endcode %}

MSIS7001: The passive protocol context was not found or not valid. If the context was stored in cookies, the cookies that were presented by the client were not valid. Ensure that the client browser is configured to accept cookies from this website and retry this request.

## Konfiguration til Azure Active Directory <a href="#configuring-for-azure-active-directory" id="configuring-for-azure-active-directory"></a>

Følg dokumentationen for konfigurationen af Azure Active Directory, der findes i dette [Microsoft-dokument](https://docs.microsoft.com/en-us/aspnet/core/security/authentication/ws-federation?view=aspnetcore-2.2#azure-active-directory).

## Konfiguration af Universal <a href="#configuring-universal-dashboard" id="configuring-universal-dashboard"></a>

### Brug Appsettings.json

Når De har konfigureret ADFS eller AAD, kan De nu angive egenskaberne til Universal for MetadataAddress og Wtrealm. Læs om disse indstillinger på vores [Indstillinger ](/powershell-universal/da/config/settings.md)side.

Her er et eksempel på, hvordan De opdaterer filen `appsettings.json`, så den indeholder de korrekte indstillinger til WS-Federation.

{% code collapsedlinecount="10" %}

```javascript
{
  "Kestrel": {
    "Endpoints": {
      "HTTP": {
        "Url": "http://*:5000"
      }
    },
    "RedirectToHttps": "false"
  },
  "ApplicationInsights": {
    "InstrumentationKey": ""
  },
  "Logging": {
    "Path": "%PROGRAMDATA%/PowerShellUniversal/log.txt",
    "RetainedFileCountLimit": 31,
    "LogLevel": {
      "Default": "Information",
      "Microsoft": "Warning",
      "Microsoft.Hosting.Lifetime": "Information"
    }
  },
  "AllowedHosts": "*",
  "CorsHosts": "",
  "Data": {
    "RepositoryPath": "%ProgramData%\\UniversalAutomation\\Repository",
    "ConnectionString": "%ProgramData%\\UniversalAutomation\\database.db",
    "GitRemote": "",
    "GitUserName": "",
    "GitPassword": "", 
    "ConfigurationScript": ""
  },
  "Api": {
    "Url": ""
  },
  "Authentication" : {
    "Windows": {
      "Enabled": "false"
    },
    "WSFed": {
        "Enabled": "true",
        "MetadataAddress": "https://ironman.local:443/FederationMetadata/2007-06/FederationMetadata.xml",
        "Wtrealm": "https://ironman.local:12345",
        "CallbackPath": "/auth/signin-wsfed"
    },
    "OIDC": {
      "Enabled": "false",
      "CallbackPath": "/auth/signin-oidc",
      "ClientID": "",
      "ClientSecret": "",
      "Resource": "",
      "Authority": "",
      "ResponseType": "",
      "SaveTokens": "false"
    },
    "SessionTimeout": "25"
  },
  "Jwt": {  
    "SigningKey": "PleaseUseYourOwnSigningKeyHere",  
    "Issuer": "IronmanSoftware",
    "Audience": "PowerShellUniversal"
  },
  "UniversalDashboard": {
    "AssetsFolder": "%ProgramData%\\PowerShellUniversal\\Dashboard"
  },
  "ShowDevTools": false,
  "HideAdminConsole": false
}
```

{% endcode %}

Når De kører Deres server, bør De nu blive bedt om Deres legitimationsoplysninger, enten via Internet Explorers enkeltlogonsystem, eller De bliver videresendt til WS-Fed-logonsiden.

### Brug Authentication.ps1

De kan konfigurere WS-Federation-godkendelse i Admin Console. Det gør De ved at gå til Secure > Authentication. Tilføj WS-Federation-udbyderen ved at vælge den i rullemenuen øverst til højre.

Rediger derefter egenskaberne for godkendelsesudbyderen, og angiv konfigurationsdetaljerne for Deres ADFS-opsætning.

Når den er konfigureret, skal De aktivere WS-Federation-udbyderen. Log derefter af, og gå til `/admin` De bliver bedt om at logge på Deres WS-Federation-udbyder.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/powershell-universal/da/sikkerhed/enterprise-security/ws-federation.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.