I'm at a loss here guys, I've looked at guide after guide after guide and they all pretty much say the same thing but I can't seem to find where I went wrong. I've got everything configured, Exchange 2013 CU21, ADFS 3.0, all running on Server
2012 R2. They're all using certificates published by my internal CA with the root ca cert pushed to all their stores via gpo. I can log into a mailbox without ADFS integration and I can pull up the ADFS metadata page. Once I run all the integration
commands and I go to https://exchange.contoso.com/owa, I am immediately directed to the ADFS page and it loops back to itself every time I enter credentials. If I enter the credentials wrong, it tells me they're wrong so I know it's checking the credentials.
There are no entries in the event logs for either Exchange or ADFS. Here's what I did:
New Rule: Exchange OWA
WS-Fed Relying URL: https://exchange.testnet.org/owa/
Issuance Transform Rules
UserSID
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]=> issue(store = "Active Directory", types = ("http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"), query = ";objectSID;{0}", param = c.Value);
UPN
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"), query = ";userPrincipalName;{0}", param = c.Value);
GroupSID
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]=> issue(store = "Active Directory", types = ("http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid"), query = ";tokenGroups(SID);{0}", param = c.Value);
New Rule: Exchange ECP
WS-Fed Relying URL: https://exchange.testnet.org/ecp/
Issuance Transform Rules
UserSID
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]=> issue(store = "Active Directory", types = ("http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid"), query = ";objectSID;{0}", param = c.Value);
UPN
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"), query = ";userPrincipalName;{0}", param = c.Value);
GroupSID
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]=> issue(store = "Active Directory", types = ("http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid"), query = ";tokenGroups(SID);{0}", param = c.Value);
Then in Exchange EMS:
Set-OrganizationConfig -AdfsIssuer https://exchange.testnet.org/adfs/ls/ -AdfsAudienceUris "https://exchange.tesnet.org/owa/", "https://exchange.testnet.org/ecp/" -AdfsSignCertificateThumpPrint thumbhere
Set-EcpVirtualDirectory -Identity "ecp (Default Web Site)" -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -WindowsAuthentication $false
Set-OwaVirtualDirectory -Identity "owa (Default Web Site)" -AdfsAuthentication $true -BasicAuthentication $false -DigestAuthentication $false -FormsAuthentication $false -OAuthAuthentication $false -WindowsAuthentication $false