adam's questions

My team are about to launch a new site, which authenticates users using SSO to our internal ADFS.

SSO works on our local and staging environments and now we're setting up what will be the live environment.

The site will be on a typical url (ie in the form www.example.com). While we're previewing it, it's temporarily on preview.example.com).

When attempting to login, we receive the error:

Invalid audience for this response
(expected 'https://www.example.com/login/saml2', got 'https://preview.example.com/login/saml2')

In my mind, there are three places this could occur:

1. In the web app (I think this is referred to as the Relying Party?)
2. In the ADFS configuration
3. Encoded in the certificates (we have idp_x509, pkey and x509)

We're pretty sure the web app is configured correctly. Our IT team think ADFS is correct (but are checking).

My question is do the certificates encode this data, such that they would need swapping out if the hostname of the relying party were to change? If so, which certificate would it likely involve?

I have a hosted webapp which requests data from a REST webservice in our office. Each page calls one (or several) webservices, which go from our host, via our firewall (a Watchguard Firebox) to a server in our office.

All of a sudden, the app has dramatically slowed. We have determined that the webservice is timing out at random when called externally (it's fine when called within the office network).

I'm pretty certain it's our connection which is dropping the webservice call, so I've written a quick php/curl script which calls the webservice over many iterations and shows the various timings.

Below is an example output, showing both a failed and a successful call (with a 5 second timeout):

    http_code           namelookup_time     connect_time        pretransfer_time    starttransfer_time  total_time          
1   0                   0.000096            0.0342              0.0000              0.0000              0.0342              
2   200                 0.000052            0.0332              0.1327              0.1751              0.1752              

As per iteration #1 above, failed requests seem to be failing between connect and pretransfer. I'm not sure if this shows that the connection is successfully past the firewall, or could the firewall still cause an issue?

Our firewall is showing a series of nondata event log messages for the relevant access rule. Our IT team tells me these are routine, although I can find no mention of these in Google. I'm not sure if this fits in between connect and pretransfer.

Having elinated the webservice server (by testing internally) and the live webapp (by testing different code on different external servers, I am left suspecting the connection to the office. Could the firebox nondata events be causing a problem between connect and pretransfer?

We've had a child DC fail on us, and can't get into Windows on it as Directory Services is failing. A restore of the backed-up active directory hasn't worked due to a corruption, and so we've decided to demote the child DC and - for now - run AD from the PDC only.

However, dcpromo /demote doesn't work from Safe Mode or Directory Services Restore Mode.

We don't want to do a complete reinstall, as we have Exchange running on the child DC.

Anyone know how (if?) we can demote the DC within safe mode or otherwise get into windows?

Thanks