Wikis - Page Details

First published by Adam Conkle - MSFT (Microsoft)
When: 17 Sep 2010 11:48 AM
Last revision by coaxke (eMicrosoft Partne)
When: 10 Jul 2013 4:26 PM
Revisions: 4
Comments: 5

Options

Can You Improve This Article?

Positively! Click Sign In to add the tip, solution, correction or comment that will help other users.

Report inappropriate content using these instructions.

AD FS 2.0: Continuously Prompted for Credentials While Using Fiddler Web Debugger

Symptoms

When using Fiddler Web Debugger to troubleshoot an AD FS 2.0 scenario, you are continuously prompted for credentials by the AD FS 2.0 Federation Server. This prompt comes in the form of a HTTP 401 challenge dialog box.

Cause

By default, AD FS 2.0 utilizes Extended Protection for Authentication (EPA) in IIS. When this is turned on, the client browser cannot successfully authenticate while Fiddler is proxying all requests.

Resolution

For troubleshooting purposes, you should disable Extended Protection for Authentication in IIS by following one of these two options:

Option 1 - IIS Manger on each ADFS server in the farm

Start > Administrative Tools > IIS Manager
Expand: <server-name>, Sites, Default Web Site, and adfs
Select the ls application and double-click Authentication
Select Windows Authentication and select Advanced Settings....
Set Extended Protection to Off and click OK

This can now be set via PowerShell at the farm level easily using PowerShell.

Open PoweShell Command Window
Load ADFS Poweshell SnapIn
Add-PsSnapIn Microsoft.Adfs.Powershell
Set ADFS to diable EAP at the farm level
Set-ADFSProperties -ExtendedProtectionTokenCheck:None
Restart ADFS and IIS

IISReset
Net Stop ADFS
Net Start ADFS

You should now be able to successfully capture a Fiddler trace from an AD FS 2.0 scenario and credentials are accepted at the first HTTP 401 challenge.

Be sure to revert your changes once you are finished troubleshooting with Fiddler.