X-MS-Endpoint-Absolute-Path This header MUST contain the full URL of the incoming request. This header MUST be included when the proxy is processing incoming requests from clients trying to access the server. String = *(%x20-7E) X-MS-Endpoint-Absolute-Path = String X-MS-Target-Role This header MUST contain the value "PrimaryComputer" to specify that a given HTTP GET request MUST perform the fetch on a server that has both read and write capabilities on the data. String = *(%x20-7E) X-MS-Target-Role = String X-MS-ADFS-Proxy-Client-IP The value of this header MUST be set to the IP address of the client's TCP/IP connection to the proxy. This header SHOULD be included when the proxy is processing incoming requests from clients that are trying to access the server.<1> String = *(%x20-7E) X-MS-ADFS-Proxy-Client-IP = String Complex Types The following are the defined types used by the protocol details. Proxy Trust This is a JSON object containing a trust certificate. The format of the object is as follows: { "SerializedTrustCertificate" : "<certificate>" } certificate: Base64 string encoded ( section 4) X509 certificate . Proxy Trust Renewal This is a JSON object containing a new trust certificate. The format of the object is as follows: { "SerializedReplacementCertificate" : "<certificate>" } certificate: Base64 string encoded ( section 4) X509 certificate . Proxy Relying Party Trust This is a JSON object containing the identifier of the web application for the proxy. The format of the object is as follows:
Timers None. Initialization None. High-Layer Triggered Events None. Message Processing Events and Sequencing Rules The following resources are available to set the publishing settings to web applications. Resource Description Proxy/RelyingPartyTrusts/{Identity}/PublishedSettings Resource used to publish a particular web application through the client. The responses to all the operations can result in the following status codes. Status code Description 200 The operation has succeeded. 400 The request is not valid. 401 Unauthorized for the specified user credentials or for the client TLS certificate. 404 The object does not exist. 405 Invalid verb used in request (GET, DELETE, POST, PUT). 409 The object already exists. 500 Version is not specified where required or any other internal error. 501 Version specified (api-version) is invalid (only valid value is 1). For all operations in this section, the server requires authenticating the proxy using client TLS authentication . The server MUST validate that the certificate that is presented by the proxy during client TLS authentication can be validated by one of the values of [Server State].ProxyTrustedCertificates. If the certificate cannot be validated, the server MUST return an HTTP error code of 401. If the operation authenticates using Integrated Windows authentication , the server MUST validate that the authenticated principal is authorized to do the corresponding operation on the server. Proxy/RelyingPartyTrusts/{Identifier}/PublishedSettings POST This operation creates a new set of publishing settings on a relying party trust. The operation is transported by a HTTP POST and can be invoked through the following URIs:
adfs/proxy/RelyingPartyTrusts/{Identifier}/PublishedSettings?api-version=1 adfs/proxy/PrimaryWriter/RelyingPartyTrusts/{Identifier}/PublishedSettings?api-version=1 If the operation is invoked through the request MUST authenticate using client TLS authentication . If the operation is invoked through adfs/proxy/PrimaryWriter/RelyingPartyTrusts/{Identifier}/PublishedSettings?api-version=1, the request MUST authenticate using Integrated Windows authentication . The response message for this operation can result in the following status codes. Status code 200 400 401 404 409 500 501 Request Body The request body MUST be a Relying Party Trust Publishing Settings (section ). Response Body No response body is returned. Processing Details If the publishing settings specified in Relying Party Trust Publishing Settings have been set previously on [Server State].RelyingPartyTrusts, the server MUST return a HTTP error code of 409. If they have not been set the server MUST add the Relying Party Trust Publishing Settings for the relying party trust identifier with {Identifier}. The server MUST add a new URL to [Server State].RelyingPartyTrusts[objectIdentifier:={Identifier}].proxyTrustedEndpoints with the value of [Relying Party Trust Publishing Settings].proxyTrustedEndpointUrl and add a new mapping to [Server State].RelyingPartyTrusts[objectIdentifier:={Identifier}].proxyEndpointMappings with the value of [Relying Party Trust Publishing Settings].internalURL to Key and [Relying Party Trust Publishing Settings].externalURL to Value. DELETE This operation removes the publishing settings for a relying party trust. The operation is transported by a HTTP DELETE and can be invoked through the following URIs: adfs/proxy/RelyingPartyTrusts/{Identifier}/PublishedSettings?api-version=1
Protocol syntax refers to data elements (such as packets, structures, enumerations, and methods) as well as interfaces. Protocol revision refers to changes made to a protocol that affect the bits that are sent over the wire. The changes made to this document are listed in the following table. For more information, please contact . Section Tracking number (if applicable) and description Major change (Y or N) Change type Normative References Updated content for this version of Windows Server. Y Content update. Messages 5374 : Revised quotation marks around values in the JSON definitions for complex types throughout this section to accurately represent data types. N Content update. Configuration 5375 : Included information for farm-behavior-version-number, and Y Content update. Serialized Request with Certificate 73195 : Added details to clarify the purpose of the serialized request contained by this object. N Content update. Certificate Validation 5379 : Updated values for this enumeration. Y Content update. Relying Party Trust State 5374 : Removed quotation marks around the value in the JSON definition for this structure to accurately represent its Boolean data type. N Content update. Message Processing Events and Sequencing Rules 5381 : Changed [Proxy Service State Data].TrustCertificate to [Client State].TrustCertificate. Y Content update. Message Processing Events and Sequencing Rules 5381 : Added content that applies to all operations in this section. Y Content update. 3.4.5 Message Processing Events and Sequencing Rules Updated content for this version of Windows Server. Y Content update. GET 5381 : Removed content because it is specified in the parent section. Y Content update. 3.4.5.1.1 GET Updated content for this version of Windows Server. Y Content update. Processing Details Updated content for this version of Windows Server. Y Content update. GET 5381 : Removed content because it is specified in the parent section. Y Content update. GET 5381 : Removed content because it is specified in the parent section. Y Content update. Message Processing Events and 5381 : Changed [Proxy Service State Data].TrustCertificate to [Client State].TrustCertificate. Y Content update.
Sequencing Rules Message Processing Events and Sequencing Rules 5381 : Updated content about client TLS authentication to indicate that it applies to all operations in this section. Y Content update. DELETE 73173 : Revised the description to call out the correct operation and behavior. Y Content update. Response Body 73173 : Clarified description. N Content update. Message Processing Events and Sequencing Rules 5381 : Added content that applies to all operations in this section. Y Content update. Message Processing Events and Sequencing Rules 5378 : Changed "PublishingSettings" to "PublishedSettings" in the resource URI listed. Y Content update. 3.8.5 Message Processing Events and Sequencing Rules 5381 : Updated content about client TLS authentication to indicate that it applies to all operations in this section. Y Content update. POST 5378 : Changed "PublishingSettings" to "PublishedSettings" where it appears in URIs. Y Content update. DELETE 5378 : Changed "PublishingSettings" to "PublishedSettings" where it appears in URIs. Y Content update. Message Processing Events and Sequencing Rules 5381 : Updated to indicate that the client uses the certificate in [Client State].TrustCertificate. Y Content update. Message Processing Events and Sequencing Rules 5381 : Updated content about client TLS authentication to indicate that it applies to all operations in this section. Y Content update. Message Processing Events and Sequencing Rules Updated content for this version of Windows Server. Y Content update. Issue Preauthentication 5380 : Updated processing rule regarding [Server State].ProxyRelyingPartyTrust. Y Content update. Proxy Preauthentication for Active Clients 5381 : Added content that applies to the operation in this section. Y Content update. Response to Active Requests 5381 : Added content that indicates that the proxy performs client TLS authentication using the certificate in [Client State].TrustCertificate. Y Content update. Appendix A: Full JSON Schema 5379 : Updated values for the CurrentEndpointConfiguration.CertificateValidation enumeration. Y Content update. 6 Appendix A: Full JSON Schema 5374 : Added definitions for the DiscoveredUpnSuffixes and CustomUpnSuffixes properties of the ServiceConfiguration object. Y Content update.