MEX 端点无法访问

Microsoft.ActiveDirectoryFederationServices.2016.TokenIssuanceFederationServerMEXEndpointMonitor (UnitMonitor)

Knowledge Base article:

摘要

无法访问用于通过 SOAP 和 HTTP 协议进行身份验证的 WS-Metadata Exchange (MEX) 端点。此监视器在联合服务器上运行。它会尝试按照设置的间隔从位于 https://<host name>/adfs/services/trust/mex 的联合服务器获取元数据交换文档。

如果可以访问联合服务器上的 MEX 端点，监视器将更改为绿色状态，并将自动解决原始的警告性警报。

原因

这可能表示联合服务器计算机上的 AD FS Windows 服务已停止。查看“警报上下文”选项卡以获得详细信息。

解决方案

验证是否已在远程联合服务器计算机上启动 AD FS Windows 服务，以及是否可访问远程联合服务器。有关详细信息，请参阅 AD FS 故障排除指南中的“验证 AD FS 是否安装和运行”和“验证网络连接”主题。

Element properties:

Target

Microsoft.ActiveDirectoryFederationServices.2016.TokenIssuance

Parent Monitor

System.Health.ConfigurationState

Category

ConfigurationHealth

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.ActiveDirectoryFederationServices.2016.TwoStateScriptMonitorType

Remotable

True

Accessibility

Public

Alert Message

MEX 端点无法访问

无法访问用于通过 SOAP 或 HTTP 协议进行身份验证的 WS-Metadata Exchange (MEX) 端点“{0}”。

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.ActiveDirectoryFederationServices.2016.TokenIssuanceFederationServerMEXEndpointMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.ActiveDirectoryFederationServices.2016.TokenIssuance" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="Normal" TypeID="Microsoft.ActiveDirectoryFederationServices.2016.TwoStateScriptMonitorType" ConfirmDelivery="false">

  <Category>ConfigurationHealth</Category>

  <AlertSettings AlertMessage="Microsoft.ActiveDirectoryFederationServices.2016.TokenIssuanceFederationServerMEXEndpointMonitor_AlertMessageResourceID">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Warning</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/Property[@Name='MexURL']$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Success" MonitorTypeStateID="Success" HealthState="Success"/>

    <OperationalState ID="Error" MonitorTypeStateID="Error" HealthState="Warning"/>

  </OperationalStates>

  <Configuration>

    <PowerShellPath>%windir%\system32\windowspowershell\v1.0\powershell.exe</PowerShellPath>

    <ScriptName>FederationServerMEXEndpointCheck.ps1</ScriptName>

    <ScriptBody><Script>

            $script:mexOK = $false

            $script:exceptionMessage = ""

            $script:mexUri = ""



            $scomapi = new-object -comObject "MOM.ScriptAPI"

            $scomapi.LogScriptEvent("ActiveDirectoryFederationServices", 600, 4, "Federation server MEX endpoint check PowerShell monitoring script")



            # Load System.ServiceModel assembly

            [System.Reflection.Assembly]::LoadWithPartialName("System.ServiceModel")



            Import-Module adfs



            if ((get-adfssyncproperties).Role -eq "PrimaryComputer")

            {

            #try

            &amp;{

            $binding = new-object System.ServiceModel.WSHttpBinding( [System.ServiceModel.SecurityMode]::Transport )

            $binding.Name = "MetadataExchangeBinding"

            $binding.Namespace = "http://schemas.microsoft.com/ws/2005/02/mex/bindings"



            $binding.Security.Mode = [System.ServiceModel.SecurityMode]::Transport

            $binding.Security.Transport.ClientCredentialType = [System.ServiceModel.HttpClientCredentialType]::None

            $binding.MaxReceivedMessageSize = 64 * 1024 * 1024



            $mexClient =  new-object System.ServiceModel.Description.MetadataExchangeClient $binding

            $uriString = Get-ADFSEndpoint | Where-Object {$_.Protocol -eq "WS-Mex"} | Select-Object FullUrl

            $uri = New-Object System.Uri $uriString.FullUrl



            $script:mexUri = $uriString.FullUrl.AbsoluteUri



            #Do Http Get of Mex

            $mexClient.GetMetadata( $uri, [System.ServiceModel.Description.MetadataExchangeClientMode]::HttpGet )



            #Do SOAP Get of Mex

            $mexClient.GetMetadata( $uri, [System.ServiceModel.Description.MetadataExchangeClientMode]::MetadataExchange )



            $script:mexOK = $true

            }

            trap [System.Exception]

            {

            $script:mexOK = $false

            $script:exceptionMessage = $_.Exception.Message

            continue

            }



            $scompb = $scomapi.CreatePropertyBag()

            $scompb.AddValue("MexOK",  $script:mexOK )

            $scompb.AddValue("MexURL",  $script:mexUri )

            $scompb.AddValue("ErrorMessage",  $script:exceptionMessage )

            $scomapi.AddItem($scompb)

            $scomapi.ReturnItems()

            }

          </Script></ScriptBody>

    <IntervalSeconds>900</IntervalSeconds>

    <TimeoutSeconds>180</TimeoutSeconds>

    <ErrorExpression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="String">Property[@Name='MexOK']</XPathQuery>

        </ValueExpression>

        <Operator>Equal</Operator>

        <ValueExpression>

          <Value Type="String">false</Value>

        </ValueExpression>

      </SimpleExpression>

    </ErrorExpression>

    <SuccessExpression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="String">Property[@Name='MexOK']</XPathQuery>

        </ValueExpression>

        <Operator>Equal</Operator>

        <ValueExpression>

          <Value Type="String">true</Value>

        </ValueExpression>

      </SimpleExpression>

    </SuccessExpression>

  </Configuration>

</UnitMonitor>