Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[pageDetectionTelemetry] Add additional requirements for AD FS 2019 #59

Open
milesgratz opened this issue Oct 21, 2019 · 0 comments
Open

Comments

@milesgratz
Copy link
Contributor

Overview

Offline Tools: AD FS Login Page Telemetry using App Insights does not support AD FS 2019 without modifying the default Content-Security-Policy response headers.

Solution

  1. Log on to the primary server in the AD FS 2019 farm
  2. Review the default/existing AD FS response headers using
    (Get-AdfsResponseHeaders).ResponseHeaders
    image
  3. Add the external Microsoft script and Application Insights endpoint URL to the Content-Security-Policy response headers
    Set-AdfsResponseHeaders -SetHeaderName "Content-Security-Policy" -SetHeaderValue "default-src 'self' 'unsafe-inline' 'unsafe-eval' https://az416426.vo.msecnd.net/scripts/a/ai.0.js https://dc.services.visualstudio.com/v2/track; img-src 'self' data:;"

Expected behavior

  1. Register an Azure Application Insights datastore
  2. Replace (or append) the onload.js from the repo
  3. Open a web browser, open the Developer Console (Ctrl+Shift+I in Google Chrome), perform an AD FS logon, and verify TelemetryManager is executing as expected.
    image
  4. Navigate to the Application Insights datastore, select Search, and verify telemetry events are written to the datastore.
    image

Actual behavior

  1. Register an Azure Application Insights datastore
  2. Replace (or append) the onload.js from the repo
  3. Open a web browser, open the Developer Console (Ctrl+Shift+I in Google Chrome), perform an AD FS logon. In the console, errors are generated:
    Refused to load the script 'https://az416426.vo.msecnd.net/scripts/a/ai.0.js' because it violates the following Content Security Policy directive:. ...
    image
    Refused to connect to 'https://dc.services.visualstudio.com/v2/track' because it violates the following Content Security Policy directive:. ...
    image
  4. Navigate to the Application Insights datastore, select Search, and no telemetry events are written to the datastore.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant