Update Claims Provider Trust in ADFS from Metadata file

If you are implementing single sign-on in your SharePoint application or any other web application, then ADFS is the default option as an Identity Provider especially when you are working with Microsoft Products and your application is authenticating from Active Directory.

ADFS can also be configured to authenticate from external provider (we will call it as Claims Provider moving forward) after performing few configuration steps. The steps will involve setting up trust between ADFS and the Claims Provider by binding certificate provided by claims provider in ADFS. We will not be looking into creating new claims provider trust because Microsoft has provided a very nice article for doing so - https://technet.microsoft.com/en-us/library/dn486771(v=ws.11).aspx

Recently I was assigned a task to update the expired Certificate and Federation Metadata for the Claims Provider from metadata file. I didn't find any straight forward article explaining how we can update the existing Claims Provider Trust from a file. Hence wanted to list down the step I followed to update the metadata for existing Claims Provider Trust.

1. Add any root certificate you may have received from the Claims Provider to the "Trusted Root Authority"
2. Open the Windows Power Shell on ADFS server
3. Run the command to add ADFS Powershell Snapin
1. Add-PSSnapin Microsoft.Adfs.PowerShell
4. Update-AdfsClaimsProviderTrust -TargetName [Name of Claims Provider Trust to update] -MetadataFile [XML file location]

The above step will update the metadata and also the certificate if provided along with Metadata. To check if certificate is present within metadata then search for  tag in the metadata file. 

Perform the below steps only if you get the following errors at ADFS at the time of login:

1. The Federation Service encountered an error while processing the WS-Trust request.Request type: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
2. Encountered error during federation passive request

Set-ADFSClaimsProviderTrust –TargetName [Name of Claims Provider Trust] –SigningCertificateRevocationCheck “None” 

*References

https://technet.microsoft.com/en-us/library/dn479400(v=wps.630).aspx

http://social.technet.microsoft.com/wiki/contents/articles/1420.ad-fs-2-0-id4037-the-key-needed-to-verify-the-signature-could-not-be-resolved-from-the-following-security-key-identifier.aspx

https://technet.microsoft.com/en-us/library/ee913566(v=ws.11).aspx

https://technet.microsoft.com/en-us/library/dn486771(v=ws.11).aspx