Return
-
Title
Having a redirect on the Default Web Site in IIS breaks Active Roles Synchronization Service Azure Back Sync Consent and automated Azure Connection creation Consent -
Description
If IIS on the Active Roles Synchronization Service host is configured with an HTTP Redirect on the root of the Default Web Site, it is not possible to complete either the Azure Back Sync creation wizard or the automated Azure Connection creation wizard. In both cases, after attempting to "Consent" permissions on the newly-created application, the redirected page will open instead of the final message confirming that the operation completed successfully. The Azure Back Sync will automatically roll-back and no changes will be made. -
Cause
This is a known issue in the Active Roles Synchronization Service.
Enhancement ID 460760 has been created so that the creation of the Azure application used by the Active Roles Synchronization Service uses a similar process to the one created by the Active Roles Administration Service, which avoids this conflict. -
Resolution
WORKAROUND 1
Create an Azure connector manually.
WORKAROUND 2
Create an Azure connector using the autocreation wizard, but apply the Application Consent via the Azure/Entra ID portal on the application directly instead of using the Active Roles Synchronization Service Console.
WORKAROUND 3
Temporarily disable the HTTP Redirect that is configured in IIS. Configure the Azure Back Sync using the wizard, then re-enable the HTTP Redirect.
STATUS
An Enhancement Request has been created to change this existing functionality in Active Roles.
Product Management will evaluate the request and this feature may become available in a future release of the product.
There are no guarantees that this specific enhancement request will be implemented in a future release.
For more information regarding our Enhancement Request policy, refer to our Global Support Guide on the Support Portal at: https://support.oneidentity.com/essentials/support-guide/ -
Change Request
460760