Set-AdfsRelyingPartyTrust

Set-AdfsRelyingPartyTrust is accessible with the help of adfs module. To install adfs on your system please refer to this adfs.

Synopsis

Sets the properties of a relying party trust.

Description

The Set-AdfsRelyingPartyTrust cmdlet configures the trust relationship with a specified relying party object.

Parameters

-AccessControlPolicyName
Specifies the name of an access control policy.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       true(ByPropertyName)
    Accept wildcard characters?  false

-AccessControlPolicyParameters <Object>


    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       true(ByPropertyName)
    Accept wildcard characters?  false

-AdditionalAuthenticationRules <String>
    Specifies the additional authorization rules to require additional authentication based on user, device and location attributes after the completion of the first step of authentication.  Note: These rules must only be configured after there is at least one authentication provider enabled for additional authentication.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       true (ByPropertyName)
    Accept wildcard characters?  false

-AdditionalAuthenticationRulesFile <String>
    Specifies a file that contains the additional authentication rules to require additional authentication when a user is attempting to access this relying party.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-AdditionalWSFedEndpoint <String[]>
    Specifies an array of alternate return addresses for the application. This is typically used when the application wants to indicate to AD FS what the return URL should be on successful token generation. AD FS requires that all acceptable URLs are entered as trusted information by the administrator.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-AllowedAuthenticationClassReferences <String[]>


    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-AllowedClientTypes <Microsoft.IdentityServer.Protocols.PolicyStore.AllowedClientTypes>
    Specifies allowed client types. The acceptable values for this parameter are:

    -- None
    -- Public
    -- Confidential

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-AlwaysRequireAuthentication <SwitchParameter>
    Indicates to always require authentication.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-AutoUpdateEnabled <Boolean]>
    Indicates whether changes to the federation metadata by the MetadataURL parameter apply automatically to the configuration of the trust relationship. If this parameter has a value of $True, partner claims, certificates, and endpoints are updated automatically.

    Note: When auto-update is enabled, fields that can be overwritten by metadata become read only.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-ClaimAccepted <ClaimDescription[]>
    Specifies an array of claims that this relying party accepts.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       true (ByValue)
    Accept wildcard characters?  false

-ClaimsProviderName <String[]>
    Specifies an array of claims provider names.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-DelegationAuthorizationRules <String>
    Specifies the delegation authorization rules for issuing claims to this relying party.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       true (ByPropertyName)
    Accept wildcard characters?  false

-DelegationAuthorizationRulesFile <String>
    Specifies a file that contains the delegation authorization rules for issuing claims to this relying party.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-EnableJWT <Boolean]>
    Indicates whether the JSON Web Token (JWT) format should be used to issue a token on a WS-Federation request. By default, SAML tokens are issued over WS-Federation.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-EncryptClaims <Boolean]>
    Indicates whether the claims that are sent to the relying party should be encrypted.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-EncryptedNameIdRequired <Boolean]>
    Indicates whether the relying party requires that the NameID claim be encrypted.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-EncryptionCertificate <X509Certificate2>
    Specifies the certificate to be used for encrypting claims that are issued to this relying party. Encrypting claims is optional.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-EncryptionCertificateRevocationCheck <String>
    Specifies the type of validation that occurs for the encryption certificate before it is used for encrypting claims to the relying party. The acceptable values for this parameter are:

    -- None
    -- CheckEndCert
    -- CheckEndCertCacheOnly
    -- CheckChain
    -- CheckChainCacheOnly
    -- CheckChainExcludingRoot
    -- CheckChainExcludingRootCacheOnly

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-Identifier <String[]>
    Specifies an array of unique identifiers for this relying party trust. No other trust can use an identifier from this list. Uniform Resource Identifiers (URIs) are often used as unique identifiers for a relying party trust, but you can use any string of characters.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-ImpersonationAuthorizationRules <String>
    Specifies the impersonation authorization rules for issuing claims to this relying party.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       true (ByPropertyName)
    Accept wildcard characters?  false

-ImpersonationAuthorizationRulesFile <String>
    Specifies a file that contains the impersonation authorization rules for issuing claims to this relying party.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-IssuanceAuthorizationRules <String>
    Specifies the issuance authorization rules for issuing claims to this relying party.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       true (ByPropertyName)
    Accept wildcard characters?  false

-IssuanceAuthorizationRulesFile <String>
    Specifies a file that contains the issuance authorization rules for issuing claims to this relying party.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-IssuanceTransformRules <String>
    Specifies the issuance transform rules for issuing claims to this relying party.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       true (ByPropertyName)
    Accept wildcard characters?  false

-IssuanceTransformRulesFile <String>
    Specifies a file that contains the issuance transform rules for issuing claims to this relying party.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-IssueOAuthRefreshTokensTo <Microsoft.IdentityServer.Protocols.PolicyStore.RefreshTokenIssuanceDeviceTypes>
    Specifies the refresh token issuance device types. The acceptable values for this parameter are:

    -- NoDevice
    -- WorkplaceJoinedDevices
    -- AllDevices

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-MetadataUrl <Uri>
    Specifies a URL at which the federation metadata for this relying party trust is available.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-MonitoringEnabled <Boolean]>
    Indicates whether periodic monitoring of this relying party federation metadata is enabled. The MetadataUrl parameter specifies the URL of the relying party's federation metadata.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-Name <String>
    Specifies the friendly name of this relying party trust.


    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-NotBeforeSkew <Int32]>
    Specifies the skew, as in integer, for the time stamp that marks the beginning of the validity period. The higher this number is, the further back in time the validity period begins with respect to the time that the claims are issued for the relying party. By default, this value is 0. Specify a positive value if validation fails on the relying party because the validity period has not yet begun.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-Notes <String>
    Specifies notes for this relying party trust.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-PassThru <SwitchParameter>
    Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-ProtocolProfile <String>
    Specifies which protocol profiles the relying party supports. The acceptable values for this parameter are: SAML and WsFederation. By default, this parameter is blank, which indicates that both protocols are supported.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-RefreshTokenProtectionEnabled <Nullable [System.Boolean]>
    Indicates that refresh token protection is enabled.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-RequestMFAFromClaimsProviders <Nullable [System.Boolean]>
    Indicates whether to use the request MFA from claims providers option.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-RequestSigningCertificate <X509Certificate2[]>
    Specifies an array of certificate that is used to verify the signature on a request from the relying party.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       true (ByValue)
    Accept wildcard characters?  false

-SamlEndpoint <SamlEndpoint[]>
    Specifies an array of Security Assertion Markup Language (SAML) protocol endpoints for this relying party.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       true (ByValue)
    Accept wildcard characters?  false

-SamlResponseSignature <String>
    Specifies the response signatures that the relying party expects. The acceptable values for this parameter are:

    -- AssertionOnly
    -- MessageAndAssertion
    -- MessageOnly

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-SignatureAlgorithm <String>
    Specifies the signature algorithm that the relying party uses for signing and verification. The acceptable values for this parameter are:

    http://www.w3.org/2000/09/xmldsig#rsa-sha1
    http://www.w3.org/2001/04/xmldsig-more#rsa-sha256

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-SignedSamlRequestsRequired <Boolean]>
    Indicates whether the Federation Service requires signed SAML protocol requests from the relying party. If you specify a value of $True, the Federation Service rejects unsigned SAML protocol requests.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-SigningCertificateRevocationCheck <String>
    Specifies the type of certificate validation that should occur when signatures on requests from the relying party are verified. The acceptable values for this parameter are:

    -- None
    -- CheckEndCert
    -- CheckEndCertCacheOnly
    -- CheckChain
    -- CheckChainCacheOnly
    -- CheckChainExcludeRoot
    -- CheckChainExcludeRootCacheOnly

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-TargetIdentifier <String>
    Specifies the identifier of the relying party trust that is modified by the cmdlet.

    Required?                    true
    Position?                    named
    Default value                none
    Accept pipeline input?       true (ByValue)
    Accept wildcard characters?  false

-TargetName <String>
    Specifies the friendly name of the relying party trust that is modified by the cmdlet.

    Required?                    true
    Position?                    named
    Default value                none
    Accept pipeline input?       true (ByValue)
    Accept wildcard characters?  false

-TargetRelyingParty <RelyingPartyTrust>
    Specifies a RelyingPartyTrust object. The cmdlet modifies the relying party trust that you specify. To obtain a RelyingPartyTrust object, use the Get-AdfsRelyingPartyTrust cmdlet.

    Required?                    true
    Position?                    named
    Default value                none
    Accept pipeline input?       true (ByValue)
    Accept wildcard characters?  false

-TokenLifetime <Int32]>
    Specifies the duration, in minutes, for which the claims that are issued to the relying party are valid.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-WSFedEndpoint <Uri>
    Specifies the WS-Federation Passive URL for this relying party.

    Required?                    false
    Position?                    named
    Default value                none
    Accept pipeline input?       false
    Accept wildcard characters?  false

-Confirm <SwitchParameter>
    Prompts you for confirmation before running the cmdlet.Prompts you for confirmation before running the cmdlet.

    Required?                    false
    Position?                    named
    Default value                false
    Accept pipeline input?       false
    Accept wildcard characters?  false

-WhatIf <SwitchParameter>
    Shows what would happen if the cmdlet runs. The cmdlet is not run.Shows what would happen if the cmdlet runs. The cmdlet is not run.

    Required?                    false
    Position?                    named
    Default value                false
    Accept pipeline input?       false
    Accept wildcard characters?  false

Syntax

Set-AdfsRelyingPartyTrust [-AllowedAuthenticationClassReferences <String[]>] [-Name <String>] [-NotBeforeSkew <Int32>] [-EnableJWT <Boolean>] [-Identifier <String[]>] [-EncryptionCertificate <X509Certificate2>] [-EncryptionCertificateRevocationCheck <String>] [-EncryptClaims <Boolean>] [-MetadataUrl <Uri>] [-IssuanceAuthorizationRules <String>] [-IssuanceAuthorizationRulesFile <String>] [-DelegationAuthorizationRules <String>] [-DelegationAuthorizationRulesFile <String>] [-ImpersonationAuthorizationRules <String>] [-ImpersonationAuthorizationRulesFile <String>] [-IssuanceTransformRules <String>] [-IssuanceTransformRulesFile <String>] [-AdditionalAuthenticationRules <String>] [-AdditionalAuthenticationRulesFile <String>] [-AccessControlPolicyName <String>] [-AccessControlPolicyParameters <Object>] [-AutoUpdateEnabled <Boolean>] [-WSFedEndpoint <Uri>] [-AdditionalWSFedEndpoint <String[]>] [-ClaimsProviderName <String[]>] [-MonitoringEnabled <Boolean>] [-Notes <String>] [-ClaimAccepted <ClaimDescription[]>] [-SamlEndpoint <SamlEndpoint[]>] [-ProtocolProfile <String>] [-RequestSigningCertificate <X509Certificate2[]>] [-EncryptedNameIdRequired <Boolean>] [-SignedSamlRequestsRequired <Boolean>] [-SamlResponseSignature <String>] [-SignatureAlgorithm <String>] [-SigningCertificateRevocationCheck <String>] [-TokenLifetime <Int32>] [-AlwaysRequireAuthentication <Boolean>] [-AllowedClientTypes <AllowedClientTypes>] [-IssueOAuthRefreshTokensTo <RefreshTokenIssuanceDeviceTypes>] [-RefreshTokenProtectionEnabled <Boolean>] [-RequestMFAFromClaimsProviders <Boolean>] -TargetIdentifier <String> [-PassThru] [-WhatIf] [-Confirm] [<CommonParameters>]

Set-AdfsRelyingPartyTrust [-AllowedAuthenticationClassReferences <String[]>] [-Name <String>] [-NotBeforeSkew <Int32>] [-EnableJWT <Boolean>] [-Identifier <String[]>] [-EncryptionCertificate <X509Certificate2>] [-EncryptionCertificateRevocationCheck <String>] [-EncryptClaims <Boolean>] [-MetadataUrl <Uri>] [-IssuanceAuthorizationRules <String>] [-IssuanceAuthorizationRulesFile <String>] [-DelegationAuthorizationRules <String>] [-DelegationAuthorizationRulesFile <String>] [-ImpersonationAuthorizationRules <String>] [-ImpersonationAuthorizationRulesFile <String>] [-IssuanceTransformRules <String>] [-IssuanceTransformRulesFile <String>] [-AdditionalAuthenticationRules <String>] [-AdditionalAuthenticationRulesFile <String>] [-AccessControlPolicyName <String>] [-AccessControlPolicyParameters <Object>] [-AutoUpdateEnabled <Boolean>] [-WSFedEndpoint <Uri>] [-AdditionalWSFedEndpoint <String[]>] [-ClaimsProviderName <String[]>] [-MonitoringEnabled <Boolean>] [-Notes <String>] [-ClaimAccepted <ClaimDescription[]>] [-SamlEndpoint <SamlEndpoint[]>] [-ProtocolProfile <String>] [-RequestSigningCertificate <X509Certificate2[]>] [-EncryptedNameIdRequired <Boolean>] [-SignedSamlRequestsRequired <Boolean>] [-SamlResponseSignature <String>] [-SignatureAlgorithm <String>] [-SigningCertificateRevocationCheck <String>] [-TokenLifetime <Int32>] [-AlwaysRequireAuthentication <Boolean>] [-AllowedClientTypes <AllowedClientTypes>] [-IssueOAuthRefreshTokensTo <RefreshTokenIssuanceDeviceTypes>] [-RefreshTokenProtectionEnabled <Boolean>] [-RequestMFAFromClaimsProviders <Boolean>] -TargetRelyingParty <RelyingPartyTrust> [-PassThru] [-WhatIf] [-Confirm] [<CommonParameters>]

Set-AdfsRelyingPartyTrust [-AllowedAuthenticationClassReferences <String[]>] [-Name <String>] [-NotBeforeSkew <Int32>] [-EnableJWT <Boolean>] [-Identifier <String[]>] [-EncryptionCertificate <X509Certificate2>] [-EncryptionCertificateRevocationCheck <String>] [-EncryptClaims <Boolean>] [-MetadataUrl <Uri>] [-IssuanceAuthorizationRules <String>] [-IssuanceAuthorizationRulesFile <String>] [-DelegationAuthorizationRules <String>] [-DelegationAuthorizationRulesFile <String>] [-ImpersonationAuthorizationRules <String>] [-ImpersonationAuthorizationRulesFile <String>] [-IssuanceTransformRules <String>] [-IssuanceTransformRulesFile <String>] [-AdditionalAuthenticationRules <String>] [-AdditionalAuthenticationRulesFile <String>] [-AccessControlPolicyName <String>] [-AccessControlPolicyParameters <Object>] [-AutoUpdateEnabled <Boolean>] [-WSFedEndpoint <Uri>] [-AdditionalWSFedEndpoint <String[]>] [-ClaimsProviderName <String[]>] [-MonitoringEnabled <Boolean>] [-Notes <String>] [-ClaimAccepted <ClaimDescription[]>] [-SamlEndpoint <SamlEndpoint[]>] [-ProtocolProfile <String>] [-RequestSigningCertificate <X509Certificate2[]>] [-EncryptedNameIdRequired <Boolean>] [-SignedSamlRequestsRequired <Boolean>] [-SamlResponseSignature <String>] [-SignatureAlgorithm <String>] [-SigningCertificateRevocationCheck <String>] [-TokenLifetime <Int32>] [-AlwaysRequireAuthentication <Boolean>] [-AllowedClientTypes <AllowedClientTypes>] [-IssueOAuthRefreshTokensTo <RefreshTokenIssuanceDeviceTypes>] [-RefreshTokenProtectionEnabled <Boolean>] [-RequestMFAFromClaimsProviders <Boolean>] -TargetName <String> [-PassThru] [-WhatIf] [-Confirm] [<CommonParameters>]

Notes
A relying party in Active Directory Federation Services (AD FS) 2.0 is an organization in which Web servers that host one or more Web-based applications reside. Tokens and Information Cards that originate from a claims provider can then be presented and ultimately accessed by the Web-based resources that are located in the relying party organization. When AD FS is configured in the role of the relying party, it acts as a partner that trusts a claims provider to authenticate users. Therefore, the relying party accesses the claims that are packaged in security tokens that come from users in the claims provider. In other words, a relying party is the organization whose Web servers are protected by the resource-side federation server. The federation server in the relying party uses the security tokens that the claims provider produces to issue tokens to the Web servers that are located in the relying party.

————————-Example 1————————-
Set the name and identifier for a relying party trust
PS C:> Set-AdfsRelyingPartyTrust -TargetName “TOSSA” -Identifier “http://TOSSA.CentralServerNew.org”
This command sets the name and identifier for the specified relying party trust.

————————-Example 2————————-
Set the target identifier for a relying party trust
PS C:> Set-AdfsRelyingPartyTrust -TargetIdentifier “http://TOSSA.CentralServer.org” -Identifier “http://TOSSA.CentralServerNew.org”
This command sets the target identifier for the specified relying party trust.

————————-Example 3————————-
Assign a policy that uses parameters
PS C:>Set-AdfsRelyingPartyTrust -TargetName “DemoRP1” -AccessControlPolicyParameters (“Administrators”,”Users”) -AccessControlPolicyName “DemoOne”
This command assigns a policy that uses parameters.

————————-Example 4————————-
Un-assign a policy template
PS C:>Set-AdfsRelyingPartyTrust -TargetName “DemoRP1” -AccessControlPolicyName $null
This command un-assigns a policy template.

You can check the Version, CommandType and Source of this cmdlet by giving below command.

Get-Command Set-AdfsRelyingPartyTrust

You can also read about

To know more PowerShell cmdlets(Commands) on Active Directory Federation Services(ADFS) click here

Click on this Link for an Single place where you get all the PowerShell cmdlet sorted based on the modules.

You can also refer other blogs on PowerShell at link

You can also refer other blogs on Microsoft at link

And also if you required any technology you want to learn, let us know below we will publish them in our site http://tossolution.com/

Like our page in Facebook and follow us for New technical information.

References are taken from Microsoft