New-AdfsSpnPlan

Business Value

The New-AdfsSpnPlan cmdlet builds a DR-524 SpnPlan from an ADFS SpnCandidate, providing a crucial step in the service principal name (SPN) registration process for Active Directory Federation Services (ADFS). This enables secure authentication and authorization between applications and resources.

• Uses: Security teams, IT administrators, DevOps engineers
• Risks:
  • Inaccurate or incomplete SPN data can lead to authentication failures.
  • Failure to register SPNs can result in security vulnerabilities.
• Manager cares when:
  • Service principal names are not registered correctly.
  • Authentication failures occur due to incorrect SPN configuration.

Day-to-Day Use

To build a DR-524 SpnPlan, follow these steps:

1. Retrieve an ADFS SpnCandidate using Get-AdfsSpnCandidate.
2. Pass the candidate to New-AdfsSpnPlan, which resolves the service account’s DistinguishedName from Active Directory.
3. The cmdlet returns a DR-524 SpnPlan describing the HTTP SPN to register.

$spnCandidate = Get-AdfsSpnCandidate -FederationServiceName "ServicePrincipal"
$newPlan = New-AdfsSpnPlan -Candidate $spnCandidate

• Common patterns:
  • Registering multiple SPNs for a service.
  • Handling errors and exceptions during the registration process.
• Watchpoints:
  • Ensure correct formatting of the SpnCandidate object.
  • Verify that the resulting SpnPlan meets organizational requirements.

Simple Explanation

New-AdfsSpnPlan takes an ADFS SpnCandidate as input and:

1. Retrieves the service account’s DistinguishedName from Active Directory.
2. Builds a DR-524 SpnPlan describing the HTTP SPN to register.
3. Returns the resulting plan.

To use this cmdlet, follow these simple steps:

1. Get an ADFS SpnCandidate using Get-AdfsSpnCandidate.
2. Pass the candidate to New-AdfsSpnPlan.
3. Review and confirm the resulting DR-524 SpnPlan.

Licence terms are proprietary and are supplied with the purchase, subscription or evaluation agreement. No open-source licence is granted.

Data Handling

The cmdlet stores and processes sensitive data, including distinguished names and SPNs.

• Transit: Data is transmitted over internal network connections.
• At-Rest: Data is stored in Active Directory and local system memory.
• Audit Trail: Changes to registered SPNs are recorded in the system’s audit trail.

Compliance Requirements

This cmdlet must comply with organizational security policies, including:

• Authorized access control for sensitive data.
• Regular review of registered SPNs for accuracy and completeness.