adfsWebCustomization icon indicating copy to clipboard operation
adfsWebCustomization copied to clipboard

[pageDetectionTelemetry] Add additional requirements for AD FS 2019

Open milesgratz opened this issue 5 years ago • 0 comments

Overview

Offline Tools: AD FS Login Page Telemetry using App Insights does not support AD FS 2019 without modifying the default Content-Security-Policy response headers.

Solution

  1. Log on to the primary server in the AD FS 2019 farm
  2. Review the default/existing AD FS response headers using (Get-AdfsResponseHeaders).ResponseHeaders image
  3. Add the external Microsoft script and Application Insights endpoint URL to the Content-Security-Policy response headers Set-AdfsResponseHeaders -SetHeaderName "Content-Security-Policy" -SetHeaderValue "default-src 'self' 'unsafe-inline' 'unsafe-eval' https://az416426.vo.msecnd.net/scripts/a/ai.0.js https://dc.services.visualstudio.com/v2/track; img-src 'self' data:;"

Expected behavior

  1. Register an Azure Application Insights datastore
  2. Replace (or append) the onload.js from the repo
  3. Open a web browser, open the Developer Console (Ctrl+Shift+I in Google Chrome), perform an AD FS logon, and verify TelemetryManager is executing as expected. image
  4. Navigate to the Application Insights datastore, select Search, and verify telemetry events are written to the datastore. image

Actual behavior

  1. Register an Azure Application Insights datastore
  2. Replace (or append) the onload.js from the repo
  3. Open a web browser, open the Developer Console (Ctrl+Shift+I in Google Chrome), perform an AD FS logon. In the console, errors are generated: Refused to load the script 'https://az416426.vo.msecnd.net/scripts/a/ai.0.js' because it violates the following Content Security Policy directive:. ... image Refused to connect to 'https://dc.services.visualstudio.com/v2/track' because it violates the following Content Security Policy directive:. ... image
  4. Navigate to the Application Insights datastore, select Search, and no telemetry events are written to the datastore.

milesgratz avatar Oct 21 '19 19:10 milesgratz