Share via

Adding second ADFS

HavrilyukRoman 21 Reputation points
2020-04-08T09:02:02.317+00:00

Hello, guys.

I have one on-prem vm, with adfs role installed. On this vm i have already configured azure ad connect, with public ssl installed. ADFS use mssql db. Sync and authorization in office 365 on this adfs server works fine. I want to add another adfs server. How should i add it, just from server manager, just choose "add to existing farm"? Or i should full reconfigure sync in "azure ad connect"?
Is that possible, to use cluster adfs without wap?
And should i have one external ip for this two nodes, or it possible to use dns round robin?

Thanks

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,265 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,112 questions
0 comments
Accepted answer
  1. AmanpreetSingh-MSFT 56,646 Reputation points
    2020-04-08T09:28:50.287+00:00

    @Roman-7880, To add second ADFS server, you just need to install ADFS Role and add the new server to existing ADFS farm.

    Should I reconfigure sync in "azure ad connect"?
    No, you don't need to reconfigure AD Connect. However, if you have only one AD Connect server in your environment, you may consider installing AD Connect on the new server and keep it in Staging mode. In Staging mode, AD Connect receives all inbound updates (imports) but doesn't export anything. So, in case if the primary AD Connect goes down, you can turn off the staging mode and use the server as production AD Connect server.

    Is that possible, to use cluster adfs without wap?
    Yes, you can configure ADFS Cluster without WAP in place. Although, from security perspective it is good to have WAP installed on a non-domain joined computer as it is installed on internet facing machine. With no WAP in place, you will have ADFS Servers facing internet and in case of compromise, malicious user will get access to the domain.

    Is it possible to use dns round robin?
    Yes, you can use DNS round robin but I always prefer NLB over DNS round robin. The reason is, if one server goes down, DNS doesn't have intelligence to detect that and it will keep resolving every second request to the server which is down. As a result 50% requests will go to the faulty node. However, NLB can detect faulty node and will send request only to the node which is up and running.

    Hope I have covered all your questions.

    Please "Accept as answer" wherever the information provided helps you to help others in the community.

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.