Several issues after you install security update 2843638 or 2843639 on an AD FS server

The following issues occur on Active Directory Federation Services (AD FS) servers that have security update 2843638 or 2843639 installed in Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008. 

Issue 1

When a sign-on (SSO) token grows too large, the user cannot authenticate with the server.

Generally, a large SSO token is caused by a user being a member of many groups.

Issue 2

Assume that you deploy AD FS as an identity provider for a federation provider, oras a Security Token Service (STS) that works as combined identity and federation provider for a token-aware application. If there is a failure in the trust relationship (for example, the relying party trust is disabled), a user keeps seeing the sign-in page instead of an error message when the user tries to perform authentication.

Issue 3

If you disable the SSO option on an AD FS server, authentication requests to the AD FS server fail.

Issue 4

When a passive authentication request to the AD FS server requires fresh authentication, the authentication fails, and the server keeps asking for credentials.

Note A claims-aware application may request fresh authentication by using the wfresh=0 parameter for the WS-Fed mechanisms. The application may instead use the ForceAuthN=true parameter for the SAMLP mechanisms.

Issue 5

For customized AD FS 2.0 deployments, customizations added after the SignIn() call in the FormsSignin.aspx.cs page code are not executed.

If you install this update on STS servers, you must also install the update on proxy servers. We recommend that you upgrade all the STS servers before you upgrade the proxy servers so that you do not have to bring down all servers in a server farm.

There is a known issue with passive HTTP basic authentication after you install this update. We recommend that you migrate the environment to forms-based authentication before you install this update.

Method 1: Windows Update

This update is available from Windows Update.

Method 2: Microsoft Download Center

The following files are available for download from the Microsoft Download Center: For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Prerequisites

To install this update, you must install Service Pack 1 for Windows Server 2008 R2, or Service Pack 2 for Windows Server 2008.

Registry information

To apply this update, you do not have to make any changes to the registry.

Restart requirement

You do not have to restart the computer after you apply this update.

Update replacement information

This update does not replace a previously released update.

File information

The global version of this update installs files that have the attributes that are listed in the following tables. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.

Windows Server 2012 file information

Notes

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.2.920 0.17xxx	Windows Server 2012	RTM	GDR
  6.2.920 0.21xxx	Windows Server 2012	RTM	LDR

• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information" section. MUM, MANIFEST, and the associated security catalog (.cat) files, are very important to maintain the state of the updated components. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.

For all supported x64-based versions of Windows Server 2012

Windows Server 2008 R2 file information

Notes

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.1.760 1.18xxx	Windows Server 2008 R2	SP1	GDR
  6.1.760 1.22 xxx	Windows Server 2008 R2	SP1	LDR

• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information" section. MUM, MANIFEST, and the associated security catalog (.cat) files, are very important to maintain the state of the updated components. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.

For all supported x64-based versions of Windows Server 2008 R2

Windows Server 2008 file information

Notes

• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information" section. MUM, MANIFEST, and the associated security catalog (.cat) files, are very important to maintain the state of the updated components. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.

For all supported x86-based versions of Windows Server 2008

For all supported x64-based versions of Windows Server 2008

Additional file information

Additional file information for Windows Server 2012

Additional files for all supported x64-based versions of Windows Server 2012

Additional file information for Windows Server 2008 R2

Additional files for all supported x64-based versions of Windows Server 2008 R2

Additional file information for Windows Server 2008

Additional files for all supported x86-based versions of Windows Server 2008

Additional files for all supported x64-based versions of Windows Server 2008

For more information about security update 2843638 or 2843639, go to the following Microsoft website:For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base: