Description of Update Rollup 3 for Active Directory Federation Services (AD FS) 2.0

Update Rollup 3 is a cumulative update package that contains all the fixes and new features that were contained in Update Rollup 1 and in Update Rollup 2. Additionally, this update fixes the following issues.

For more information about Update Rollup 1 for AD FS 2.0, click the following article number to view the article in the Microsoft Knowledge Base:

2607496 Description of Update Rollup 1 for Active Directory Federation Services (AD FS) 2.0

For more information about Update Rollup 2 for AD FS 2.0, click the following article number to view the article in the Microsoft Knowledge Base:

2681584 Description of Update Rollup 2 for Active Directory Federation Services (AD FS) 2.0

Issue 1

AD FS 2.0 does not issue an ActAs token for a relying party who is using a Security Assertion Markup Language (SAML) 2.0 bootstrap token. When this issue occurs, the following error is generated:After you apply AD FS 2.0 update rollup 3, AD FS 2.0 successfully issues the token in this situation.

Issue 2

AD FS 2.0 update rollup 2 introduced strict Uniform Resource Identifier (URI) checking. When AD FS 2.0 acts as a federation provider and trusts an identity provider whose identifier is not an URI, the response that is returned from the identity provider is rejected by AD FS 2.0. The validation fails because AD FS 2.0 tries to validate the value of the identity provider’s identifier. This behavior breaks previously functioning AD FS 2.0 deployments in which identity providers use non-URI identifiers. AD FS 2.0 update rollup 3 removes this URI checking.

Issue 3

Some relying parties require that signature certificates are applied to the relying party for SAML requests, as signature certificates provide a critical security validation function and are defined in the SAML 2.0 specification. AD FS 2.0 is capable of allowing unique signature certificates to be applied to a relying party trust, but it only allows the same certificate to be applied to one relying party trust per AD FS 2.0 farm. This restriction prevents multiple relying parties from using the same signing certificate for SAML requests. AD FS 2.0 update rollup 3 removes this restriction and allows multiple relying parties to use the same signing certificate for SAML request.

Note After applying update rollup 3, you will need to manually run a script to make the fix for this issue work. For information about how to do this, please go to the "Hotfix information" section.

Issue 4

Consider the following scenario:

• You use a third-party hardware security module (HSM) to speed up the signing processes.
• You use the third-party HSM and to generate and store the private keys.
• The private keys are for AD FS 2.0 signing and for AD FS 2.0 encryption certificates.

In this situation, the performance of AD FS 2.0 is not as good as when you use Microsoft CSP. AD FS 2.0 update rollup 3 significantly improves the performance of AD FS 2.0 when HSM is used.

Issue 5

AD FS 2.0 update rollup 1 introduces the Congestion Avoidance Algorithm. If you accidentally disable the Congestion Avoidance Algorithm by changing the configuration, a handle leak occurs on an AD FS 2.0 federation server proxy every time that the federation server proxy processes a request. AD FS 2.0 update rollup 3 removes the setting that enables you to disable Congestion Avoidance Algorithm by changing the configuration. You can fine tune the Congestion Avoidance Algorithm by adjusting the latencyThresholdInMsec and minCongestionWindowSize settings.