Environment:
- Active Directory Federation Service (AD FS) role configured on Windows 2012 R2 Active Directory Directory Services (AD DS) Domain Controller (DC)
- WAP 2012 R2 (not domain joined)
- Office 365 tenant subscription w/ on-premises AD synchronizing a federated domain
Error: Under the Remote Access Management console on the WAP Server, Operation Status node shows Web Application Proxy and Web Application Proxy Core as failed while AD FS Proxy status is working. Also, the following error message is observed in the event logs:
Component : Web Application Proxy Core
RemoteAccessServer : <SERVERNAME>
HealthState : Error
Heuristics : {Id: 1002, ErrorDesc: Web Application Proxy: Web Application Proxy service is down., ErrorCause:
An unknown error had occured, ErrorResoln: Please refer to TechNet library in
http://technet.com/ServiceWAP, OperationStatus: Unknown error, Status: Error}
TimeStamp : <DATE & TIME OCCURED>
Cause: Experienced the preceding error after certificate changes in the AD FS farm.
Symptoms:
- AD FS authentication form does not appear when opening a published URL. Web browser displays a nondescript error.
Resolution: Need to refresh the Web App Proxy / Core configuration by issuing the following PowerShell commands on the WAP Server:
Get-ChildItem -Path Cert:\LocalMachine\My | Select Subject, FriendlyName, Thumbprint | fl
Install-WebApplicationProxy -CertificateThumbprint '<THUMBPRINT OBTAINED FROM PREVIOUS PS COMMAND OUTPUT>' -FederationServiceName 'adfs.contoso.com' (change 'adfs.contoso.com' to your specific STS URL)
Restart-Service adfssrv