Issue to use ADFS Extranet Smart Lockout with non-claims-aware application
Based on my tests, ADFS does not register the original client IP, if the client logs on to a non-claims-aware application published by the Web Application Proxy. In this case, the AD FS Auditing event ID 1200 shows only the WAP server’s IP: <Component xsi:type="RequestAuditComponent"> <Server>http://<adfs server fqdn>/adfs/services/trust</Server> <AuthProtocol>MSISActive</AuthProtocol> <NetworkLocation>Extranet</NetworkLocation> <IpAddress>10.9.40.84</IpAddress> <ForwardedIpAddress /> <ProxyIpAddress>N/A</ProxyIpAddress> <NetworkIpAddress>N/A</NetworkIpAddress> <ProxyServer>WAP</ProxyServer> <UserAgentString>N/A</UserAgentString> <Endpoint>/adfs/proxy/relyingpartytoken</Endpoint> </Component> If a client from the same IP logs on to a claims aware way published application the IpAddress and ForwardedIpAddress fields are containing the original client IP and the load balancer’s IP sitting before the WAP: <Component xsi:type="RequestAuditComponent"> <Server>http://<adfs server fqdn>/adfs/services/trust</Server> <AuthProtocol>WSFederation</AuthProtocol> <NetworkLocation>Extranet</NetworkLocation> <IpAddress>93.33.65.135,10.9.40.40</IpAddress> <ForwardedIpAddress>93.33.65.135,10.9.40.40</ForwardedIpAddress> <ProxyIpAddress>N/A</ProxyIpAddress> <NetworkIpAddress>N/A</NetworkIpAddress> <ProxyServer>ORFK-WAP02</ProxyServer> <UserAgentString>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Edg/125.0.0.0</UserAgentString> <Endpoint>/adfs/ls/</Endpoint> </Component> Consequently, after a successful logon to this non-claims-aware application the WAP IP will be registered as a FamiliarIp in ADFS, and any further logon attempt will be counted as a familiar authentication even if it’s coming from an attackers IP, since the original client IP remains hided for the ADFS ESL service. Maybe I misconfigured something, or should it be by design? Any idea would be appreciated. Best Regards, Mike