ã“ã®ãƒ¢ãƒ‹ã‚¿ãƒ¼ã¯ã€ãƒˆãƒ¼ã‚¯ãƒ³ã®ãƒªãƒ—レイ検出ãŒå¤±æ•—ã—ãŸã“ã¨ã‚’示ã—ã¾ã™ã€‚ã“ã‚Œã«ã‚ˆã‚Šã€ãƒ•ã‚§ãƒ‡ãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ サービスã¯ãƒˆãƒ¼ã‚¯ãƒ³ã‚’å—ã‘入れるã“ã¨ãŒã§ããªããªã‚Šã¾ã™ã€‚
åŒã˜å•é¡ŒãŒ 15 分以内ã«å†ç™ºã—ãªã„å ´åˆã¯ã€ã“ã®ãƒ¢ãƒ‹ã‚¿ãƒ¼ã®ãƒ˜ãƒ«ã‚¹çŠ¶æ…‹ã¯ç·‘色ã®çŠ¶æ…‹ã«æˆ»ã‚Šã¾ã™ã€‚
アーティファクト解決サービスをåˆæœŸåŒ–ã§ããªã„å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ã“ã‚Œã¯ä¸€èˆ¬ã«ã€ã‚¢ãƒ¼ãƒ†ã‚£ãƒ•ã‚¡ã‚¯ãƒˆè§£æ±ºã‚µãƒ¼ãƒ“スを必è¦ã¨ã™ã‚‹æ§‹æˆã®å¤‰æ›´ã‚’有効ã«ã—ãŸãŒã€AD FS Windows サービスをå†èµ·å‹•ã—ãªã‹ã£ãŸå ´åˆã«ç™ºç”Ÿã—ã¾ã™ã€‚AD FS アーティファクト解決サービスを必è¦ã¨ã™ã‚‹æ§‹æˆè¨å®šã‚’以下ã«ç¤ºã—ã¾ã™ã€‚
トークン リプレイ検出
OAuth プãƒãƒˆã‚³ãƒ« エンドãƒã‚¤ãƒ³ãƒˆ
SAML アーティファクト解決エンドãƒã‚¤ãƒ³ãƒˆ
上記ã®æ©Ÿèƒ½ã®ã„ãšã‚Œã‹ã‚’有効ã«ã—ãŸå ´åˆã¯ã€AD FS Windows サービスをå†èµ·å‹•ã—ã¦ãã ã•ã„。
Target | Microsoft.ActiveDirectoryFederationServices.2016.TokenAcceptance | ||
Parent Monitor | System.Health.ConfigurationState | ||
Category | ConfigurationHealth | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | MatchMonitorHealth | ||
Alert Priority | Normal | ||
Alert Auto Resolve | True | ||
Monitor Type | Microsoft.Windows.SingleEventLogTimer2StateMonitorType | ||
Remotable | True | ||
Accessibility | Public | ||
Alert Message |
| ||
RunAs | Default |
<UnitMonitor ID="Microsoft.ActiveDirectoryFederationServices.2016.TokenAcceptanceArtifactServiceNotRunningForReplayDetectionCheckMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.ActiveDirectoryFederationServices.2016.TokenAcceptance" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.SingleEventLogTimer2StateMonitorType" ConfirmDelivery="true">
<Category>ConfigurationHealth</Category>
<AlertSettings AlertMessage="Microsoft.ActiveDirectoryFederationServices.2016.TokenAcceptanceArtifactServiceNotRunningForReplayDetectionCheckMonitor_AlertMessageResourceID">
<AlertOnState>Error</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>MatchMonitorHealth</AlertSeverity>
</AlertSettings>
<OperationalStates>
<OperationalState ID="EventRaised" MonitorTypeStateID="EventRaised" HealthState="Error"/>
<OperationalState ID="TimerEventRaised" MonitorTypeStateID="TimerEventRaised" HealthState="Success"/>
</OperationalStates>
<Configuration>
<ComputerName>$Target/Host/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>$Target/Host/Host/Property[Type="Microsoft.ActiveDirectoryFederationServices.2016.FederationServer"]/ADFSEventLog$</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">104</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>MatchesMOM2005RegularExpression</Operator>
<Pattern>(^AD FS$)</Pattern>
</RegExExpression>
</Expression>
</And>
</Expression>
<TimerWaitInSeconds>900</TimerWaitInSeconds>
</Configuration>
</UnitMonitor>