AD FS – Troubleshooting AD FS event ‘web.config file is malformed’

Hi mates. Today we’re going to cover a specific error when establishing trust between Web Application Proxy and AD FS servers: “The Web request failed because the web.config file is malformed”.

The microsoft.identityServer.proxyservice.exe.config is a file that holds some proxy configurations such as trust certificate thumbprint, congestion control thresholds, client service ports, AD FS federation service name and other configurations.

Error

You might face error below when trying to establish or reestablish the trust between WAP and AD FS:

An error occurred attempting to update the proxy service configuration file. An error occurred when attempting to save the proxy configuration.

In case you are using the WAP configuration wizard, you might face error below:

More details about the error, you can find in the Event viewer » Applications and Services Logs » AD FS » Admin.

Log Name: AD FS/Admin
Source: AD FS
Event ID: 383
Task Category: None
Level: Error
Keywords: AD FS
Computer: WAP.domain
Description: The Web request failed because the web.config file is malformed.
User Action: Fix the malformed data in the web.config file.
Exception details:
Root element is missing. (C:\windows\ADFS\Config\microsoft.identityServer.proxyservice.exe.config)
Root element is missing.
Investigating the error

Once the event above give us more information about the issue, let’s check if the file microsoft.identityServer.proxyservice.exe.config is created and has the proxy configurations on it.

Checking C:\windows\ADFS\Config\ path, we opened the file and confirmed that it’s empty:

FIX:

To fix this issue, we need to recover the file microsoft.identityServer.proxyservice.exe.config before reestablishing the trust. To achieve this goal, we have two options:

Option 1 – Copy valid file from another WAP server

In case you have another working WAP server, follow steps below:

1 – Copy file microsoft.identityServer.proxyservice.exe.config from a WAP server that is working into folder C:\Windows\ADFS\Config in the non-working WAP server.
2 – Establish the trust between WAP and AD FS using commands below:

$FScredential = Get-Credential
Install-WebApplicationProxy -FederationServiceName "FS01.Contoso.com" -FederationServiceTrustCredential $FScredential -CertificateThumbprint "0a1b2c3d0a1b2c3d0a1b2c3d0a1b2c3d0a1b2c3d"

Note: Modify the Federation Service name and Certificate Thumbprint according to your environment.

Option 2 – Uninstall WAP role using PowerShell

To uninstall the feature using PowerShell, run command below:

Remove-WindowsFeature -Name Web-application-proxy

After the process is finished, reboot the WAP server.

Reinstalling WAP role using PowerShell

To reinstall the feature using PowerShell, run the command below:

Install-WindowsFeature Web-Application-Proxy -IncludeManagementTools

In my scenario, I renamed the blank configuration file to .old to confirm the new one was created by the wizard.

After the service is reinstalled, we can reestablish the trust using commands below:

$FScredential = Get-Credential
Install-WebApplicationProxy -FederationServiceName "FS01.Contoso.com" -FederationServiceTrustCredential $FScredential -CertificateThumbprint "0a1b2c3d0a1b2c3d0a1b2c3d0a1b2c3d0a1b2c3d"

Note: Modify the Federation Service name and Certificate Thumbprint according to your environment.

With the successful trust configuration. you might see event 245 being registered on WAP server:

Log Name: AD FS/Admin
Source: AD FS
Event ID: 245
Task Category: None
Level: Information
Keywords: AD FS
Computer: WAP
Description: The federation server proxy successfully retrieved and updated its configuration from the Federation Service ‘XXXXXXXX’.

Summary

In this article, we covered how to troubleshoot error ‘The Web request failed because the web.config file is malformed.’ when establishing the trust between WAP and AD FS server.

I hope you have enjoyed reading this article, and it helps you to manage your AD FS environment.

Enjoyed the article? Like and share. 🙂

In case you have any suggestion or feedback, please leave a comment.

[ ]’s

Ulysses Neves