Copy RSA Master Key to new ADFS farm

[derSchweiger]

We are currently using your ADFS MFA plugin in our existing ADFS farm, with Active Directory configured as the storage backend.

As part of our disaster recovery strategy, we have now deployed an additional, independent ADFS farm within the same Active Directory domain. Our goal is to secure this DR ADFS farm using the same MFA plugin configuration and reuse the existing RSA master key. So I've a few questions:

• Where is the RSA master key stored?
• What steps are required to ensure that the same RSA master key is used in the new ADFS farm?
• Are there any additional considerations we should be aware of when implementing this setup?

[redhook62]

Hi,

One advantage is that you're positioning your disaster recovery platform on the same Active Directory forest.
You'll find your users with the same attributes used in production.

Where is the RSA encryption key located? It's not stored anywhere by MFA, but exists somewhere on your ADDS.
If you're using ECDH_P256 encryption (Elliptic-Curve Diffie-Hellman), it's simply possible to copy the keys between the servers in the farm (these keys are stored in the Windows system in this case).

It's crucial for the plugin that the MFA configuration is exactly the same as in production. You absolutely must have the same passphrase. Export the production configuration using Export-MFASystemConfiguration. Then modify the XML file to:

• change the names of the existing ADFS servers
• replace all encrypted passwords with their plaintext values
• use the exact same ADFS/MFA service accounts

Then, import the modified configuration into the new farm

Then you have to test

[derSchweiger]

Thank you, I'll give it a try and will report back.

[derSchweiger]

One more question to better understand the RSA key principle.

You said "It's not stored anywhere by MFA, but exists somewhere on your ADDS". Which key is used and how get it generated in the first place? The key get generated by ADDS on its own and your plugin refers to it?

[redhook62]

I'd rather not reveal the key used publicly. You can find it by looking at the source code.
If you prefer, send me an email address, and I'll explain it in detail.

adfsmfa@gmail.com