Hi guys. Today I will share with you quickly a security feature on AD FS called Banned IP List. It was introduced on Windows Server version 2016 to help admins control access to applications hosted in AD FS based on IP. It can be considered in scenarios where admins want to block IPs that are considered malicious or for any reason should not access Applications integrated to AD FS.
Let’s start enabling this feature on AD FS primary server running command below in PowerShell:
Set-AdfsProperties -AddBannedIps "111.222.333.444"
Note: In this demonstration, we’re going to configure my specific public IP, but you can configure a single IP or a range of IPs to be blocked.
Testing access to Application
Users that have the IP added to the banned list, will face an error Incorrect user ID or password. Type the correct user ID and password, and try again. that is similar to the error when you provide bad credentials:
Checking debug logs on AD FS
To get into more details in how AD FS validates the credential, I’ve enabled the Debug logs in the AD FS server.
The IP validation is part of the process called Pre-Auth Check and starts calling BannedIpProvider to get information about IPs marked as banned in the AD FS database.
AD FS matches the Ips registered as banned in its database against the incoming IP or IP in the x-forwarded-for or x-ms-forwarded-client-ip headers to block or allow the authentication.
As my public IP matches to the one registered in the Banned Ip list, the result is blocking.
And the response from Banned Ip Provider is Deny request due to ip xxx.xxx.xxx.xxx (incoming IP).
As result, we can see Exception in Event viewer showing as MSIS7010:Authentication failed.
Removing IPs from the Banned Ip List
To remove the IP or a range of IPs from the Banned Ip List, run the command below:
Note: Change the IP below to the IP or IP range you wish to unblock.
Set-AdfsProperties -RemoveBannedIps "111.222.333.444"
Testing access to Application
After I’ve removed my public IP from the Banned Ip List, my test user fred@ulyneves.com was able to access Office 365 through AD FS.
Checking debug logs on AD FS
Now that we have a successful sign in, let’s check the in details the same information, but now with an IP that is not in the banned list.
Checking event below, we see AD FS loading the banned Ip list from its database.
In the next step, we see AD FS service matching the received IP against the list of banned Ips in the AD FS database.
The result now is Allow request.
With allowed result generated by BannedIpProvider validation, the event below can be seen as the result for Analyze Pre-Auth Request: AnalyzePreAuthRequest BannedIpProvider returned Unrestricted
Summary
In this article, we covered the feature Banned Ip List on AD FS, shared in details how the Ips are validated when this feature is configured and the user experience when the IP is banned.
I hope you have enjoyed reading this article and it helps you when administering your AD FS environment.
Enjoyed the article? Like and share. 🙂
In case you have any suggestion or feedback, please leave a comment.
[ ]’s
Ulysses Neves
