Mex-eindpunt is niet bereikbaar

Microsoft.ActiveDirectoryFederationServices.2016.TokenIssuanceFederationServerMEXEndpointMonitor (UnitMonitor)

Knowledge Base article:

Samenvatting

Het WS-MEX-eindpunt (Metadata Exchange) dat wordt gebruikt voor verificatie via SOAP- en HTTP-protocollen is niet bereikbaar. Deze monitor wordt uitgevoerd op de federatieserver. Op ingestelde intervallen probeert deze het Metadata Exchange-document van de federatieserver op te halen op https://<host name>/adfs/services/trust/mex.

Als het MEX-eindpunt op de federatieserver niet bereikbaar wordt, krijgt de monitor de status Groen en wordt de oorspronkelijke waarschuwing automatisch gewist.

Oorzaken

Dit betekent mogelijk dat de Windows-service AD FS op de computer van de federatieserver is gestopt. Kijk op het tabblad Waarschuwingscontext voor meer informatie.

Oplossingen

Controleer of de Windows-service AD FS is gestart op de computer van de externe federatieserver en of de externe federatieserver bereikbaar is. Zie voor meer informatie de onderwerpen 'Controleren of AD FS geïnstalleerd en actief is' en 'Netwerkverbindingen controleren' in de AD FS-probleemoplossingsgids.

Element properties:

TargetMicrosoft.ActiveDirectoryFederationServices.2016.TokenIssuance
Parent MonitorSystem.Health.ConfigurationState
CategoryConfigurationHealth
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.ActiveDirectoryFederationServices.2016.TwoStateScriptMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
Mex-eindpunt is niet bereikbaar
Het WS-MEX-eindpunt (Metadata Exchange) {0} dat wordt gebruikt voor verificatie via SOAP- en HTTP-protocollen is niet bereikbaar.
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.ActiveDirectoryFederationServices.2016.TokenIssuanceFederationServerMEXEndpointMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.ActiveDirectoryFederationServices.2016.TokenIssuance" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="Normal" TypeID="Microsoft.ActiveDirectoryFederationServices.2016.TwoStateScriptMonitorType" ConfirmDelivery="false">
<Category>ConfigurationHealth</Category>
<AlertSettings AlertMessage="Microsoft.ActiveDirectoryFederationServices.2016.TokenIssuanceFederationServerMEXEndpointMonitor_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Warning</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/Property[@Name='MexURL']$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="Success" MonitorTypeStateID="Success" HealthState="Success"/>
<OperationalState ID="Error" MonitorTypeStateID="Error" HealthState="Warning"/>
</OperationalStates>
<Configuration>
<PowerShellPath>%windir%\system32\windowspowershell\v1.0\powershell.exe</PowerShellPath>
<ScriptName>FederationServerMEXEndpointCheck.ps1</ScriptName>
<ScriptBody><Script>
$script:mexOK = $false
$script:exceptionMessage = ""
$script:mexUri = ""

$scomapi = new-object -comObject "MOM.ScriptAPI"
$scomapi.LogScriptEvent("ActiveDirectoryFederationServices", 600, 4, "Federation server MEX endpoint check PowerShell monitoring script")

# Load System.ServiceModel assembly
[System.Reflection.Assembly]::LoadWithPartialName("System.ServiceModel")

Import-Module adfs

if ((get-adfssyncproperties).Role -eq "PrimaryComputer")
{
#try
&amp;{
$binding = new-object System.ServiceModel.WSHttpBinding( [System.ServiceModel.SecurityMode]::Transport )
$binding.Name = "MetadataExchangeBinding"
$binding.Namespace = "http://schemas.microsoft.com/ws/2005/02/mex/bindings"

$binding.Security.Mode = [System.ServiceModel.SecurityMode]::Transport
$binding.Security.Transport.ClientCredentialType = [System.ServiceModel.HttpClientCredentialType]::None
$binding.MaxReceivedMessageSize = 64 * 1024 * 1024

$mexClient = new-object System.ServiceModel.Description.MetadataExchangeClient $binding
$uriString = Get-ADFSEndpoint | Where-Object {$_.Protocol -eq "WS-Mex"} | Select-Object FullUrl
$uri = New-Object System.Uri $uriString.FullUrl

$script:mexUri = $uriString.FullUrl.AbsoluteUri

#Do Http Get of Mex
$mexClient.GetMetadata( $uri, [System.ServiceModel.Description.MetadataExchangeClientMode]::HttpGet )

#Do SOAP Get of Mex
$mexClient.GetMetadata( $uri, [System.ServiceModel.Description.MetadataExchangeClientMode]::MetadataExchange )

$script:mexOK = $true
}
trap [System.Exception]
{
$script:mexOK = $false
$script:exceptionMessage = $_.Exception.Message
continue
}

$scompb = $scomapi.CreatePropertyBag()
$scompb.AddValue("MexOK", $script:mexOK )
$scompb.AddValue("MexURL", $script:mexUri )
$scompb.AddValue("ErrorMessage", $script:exceptionMessage )
$scomapi.AddItem($scompb)
$scomapi.ReturnItems()
}
</Script></ScriptBody>
<IntervalSeconds>900</IntervalSeconds>
<TimeoutSeconds>180</TimeoutSeconds>
<ErrorExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">Property[@Name='MexOK']</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">false</Value>
</ValueExpression>
</SimpleExpression>
</ErrorExpression>
<SuccessExpression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">Property[@Name='MexOK']</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">true</Value>
</ValueExpression>
</SimpleExpression>
</SuccessExpression>
</Configuration>
</UnitMonitor>