AD FS Logon Page Graphics

Question

Greetings,

I've deployed an AD FS server successfully in an isolated environment (no Internet). When I get to the AD FS logon page, there are no graphics, just text and related fields. I'm not having any luck finding a resolution. The system works properly otherwise.

Has anyone experienced this?

Thanks,

Chris

Answer 1

Sikumars,

after breaking and troubleshooting ADFS after a backup, uninstall, re-install and restore, I have found a workaround here:

https://social.technet.microsoft.com/Forums/Lync/en-US/2df3ef95-b0e1-4a89-96ce-3fd4edd7a7f9/failed-to-start-endpoint-https49443adfsportal?forum=ADFS

I've added my Group Managed Service Account to the local admins group and now the graphics on the logon page appear. I've also tried the "fix" described by one of the users yet it does not work. Only adding the gmsa to the admins group allows the site to present normally.

I may not be applying the fix properly as I don't quite understand all that he is referring to. I tried modifying the url acl permission for https://+:443/adfs by deleting the existing perms for User: NT SERVICE\adfssrv and adding my gmsa service account yet there was no change after restarting services.

Does this make sense to you?

I apologize if I don't reply to any responses as I'm leaving town for about a week.

Thanks for the help,

TP

Answer 2

Thanks vipulsparsh-MSFT,
I'm referring to out-of-the-box default theme or otherwise. Currently targeting the default theme. I'm assuming it should resemble one of the attached. Ran the command as requested with no change.

Answer 3

Update,
Using browser development tools, I'm finding that any content at the location "https://<adfsservername>.domain/adfs/portal/..." can't be found and each item returns "503 service unavailable". My understanding is that the source of the adfs pages is in http.sys. I'm told there is no physical directory for the site. Content located at "https://<adfsservername>.domain/adfs/ls/..." is, however, returned successfully by the browser.

How do I resolve this?

Thanks,

TP

Answer 4

Hello @Two Planker ,

I have been working on this thread with Vipul to replicate a few instances in my lab, and I would like to double-check the following points to ensure you observe something similar in your ADFS environment.

As you mentioned ADFS endpoints are built on http.sys engine, so there's no physical directory. To isolate the issue, try to restarting the ADFS service to ensure you see success event shown below for the https://+:443/adfs/portal/ endpoint.

If you see success, then try accessing below /adfs/portal/ endpoint on the ADFS server to ensure the "illustration" image and style.css file are displayed on browser.

https://<adfsservername>.domain/adfs/portal/illustration/illustration.png
https://<adfsservername>.domain/adfs/portal/css/style.css

If you receive "HTTP 503 - The service is unavailable", then use localhost instead of <adfsservername>.domain name in the URL as shown below, by this way to ensure ADFS requests are served by same. When using localhost, you may receive a certificate warning, as shown below, but if you ignore the warning, the illustration image should load successfully.

https://localhost/adfs/portal/illustration/illustration.png
https://localhost/adfs/portal/css/style.css

For example, if you have more than one ADFS instance in the farm, there is a chance that a request will be routed to any instance in the farm when you have a load balancer in place so to isolate the issue, try adding the IP address of a federation server to the hosts file as explained here and try reproducing the issue after restarting ADFS service and share screenshot of ADFS page outcome.

Hope this helps.

------
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 5

Thanks Sikumars,

when I restart the AD FS services, I get no entries of any kind in that log although it appears such an entry was logged when the feature was first enabled. Also, when I try to access the two URL's, whether using the IP or localhost, I get the 503 service unavailable error. Note the deployment consists of only one server.

TP