100 lines
8.6 KiB
Markdown
100 lines
8.6 KiB
Markdown
# adfs collector
|
|
|
|
The ADFS collector exposes metrics about Active Directory Federation Services. Note that this collector has only been tested against ADFS 4.0/ [Farm Behavior (FLB) 3](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server#ad-fs-farm-behavior-levels-fbl) (Server 2016).
|
|
Other ADFS versions may work but are not tested.
|
|
|
|
|||
|
|
-|-
|
|
Metric name prefix | `adfs`
|
|
Data source | Perflib
|
|
Counters | `AD FS`
|
|
Enabled by default? | No
|
|
|
|
## Flags
|
|
|
|
None
|
|
|
|
## Metrics
|
|
|
|
Name | Description | Type | Labels
|
|
-----|-------------|------|-------
|
|
`windows_adfs_ad_login_connection_failures_total` | Total number of connection failures between the ADFS server and the Active Directory domain controller(s) | counter | None
|
|
`windows_adfs_certificate_authentications_total` | Total number of [User Certificate](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-user-certificate-authentication) authentications. I.E. smart cards or mobile devices with provisioned client certificates | counter | None
|
|
`windows_adfs_device_authentications_total` | Total number of [device authentications](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/device-authentication-controls-in-ad-fs) (SignedToken, clientTLS, PkeyAuth). Device authentication is only available on ADFS 2016 or later | counter | None
|
|
`windows_adfs_extranet_account_lockouts_total` | Total number of [extranet lockouts](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-extranet-smart-lockout-protection). Requires the Extranet Lockout feature to be enabled | counter | None
|
|
`windows_adfs_federated_authentications_total` | Total number of authentications from federated sources. E.G. Office365 | counter | None
|
|
`windows_adfs_passport_authentications_total` | Total number of authentications from [Microsoft Passport](https://en.wikipedia.org/wiki/Microsoft_account) (now named Microsoft Account) | counter | None
|
|
`windows_adfs_password_change_failed_total` | Total number of failed password changes. The Password Change Portal must be enabled in the AD FS Management tool in order to allow user password changes | counter | None
|
|
`windows_adfs_password_change_succeeded_total` | Total number of succeeded password changes. The Password Change Portal must be enabled in the AD FS Management tool in order to allow user password changes | counter | None
|
|
`windows_adfs_token_requests_total` | Total number of requested access tokens | counter | None
|
|
`windows_adfs_windows_integrated_authentications_total` | Total number of Windows integrated authentications using Kerberos or NTLM | counter | None
|
|
`ad_login_connection_failures_total` | Total number of connection failures to an Active Directory domain controller | counter | None
|
|
`certificate_authentications_total` | Total number of User Certificate authentications | counter | None
|
|
`device_authentications_total` | Total number of Device authentications | counter | None
|
|
`extranet_account_lockouts_total` | Total number of Extranet Account Lockouts | counter | None
|
|
`federated_authentications_total` | Total number of authentications from a federated source | counter | None
|
|
`passport_authentications_total` | Total number of Microsoft Passport SSO authentications | counter | None
|
|
`passive_requests_total` | Total number of passive (browser-based) requests | counter | None
|
|
`password_change_failed_total` | Total number of failed password changes | counter | None
|
|
`password_change_succeeded_total` | Total number of successful password changes | counter | None
|
|
`token_requests_total` | Total number of token requests | counter | None
|
|
`windows_integrated_authentications_total` | Total number of Windows integrated authentications (Kerberos/NTLM) | counter | None
|
|
`oauth_authorization_requests_total` | Total number of incoming requests to the OAuth Authorization endpoint | counter | None
|
|
`oauth_client_authentication_success_total` | Total number of successful OAuth client Authentications | counter | None
|
|
`oauth_client_authentication_failure_total` | Total number of failed OAuth client Authentications | counter | None
|
|
`oauth_client_credentials_failure_total` | Total number of failed OAuth Client Credentials Requests | counter | None
|
|
`oauth_client_credentials_success_total` | Total number of successful RP tokens issued for OAuth Client Credentials Requests | counter | None
|
|
`oauth_client_privkey_jwt_authentication_failure_total` | Total number of failed OAuth Client Private Key Jwt Authentications | counter | None
|
|
`oauth_client_privkey_jwt_authentications_success_total` | Total number of successful OAuth Client Private Key Jwt Authentications | counter | None
|
|
`oauth_client_secret_basic_authentications_failure_total` | Total number of failed OAuth Client Secret Basic Authentications | counter | None
|
|
`oauth_client_secret_basic_authentications_success_total` | Total number of successful OAuth Client Secret Basic Authentications | counter | None
|
|
`oauth_client_secret_post_authentications_failure_total` | Total number of failed OAuth Client Secret Post Authentications | counter | None
|
|
`oauth_client_secret_post_authentications_success_total` | Total number of successful OAuth Client Secret Post Authentications | counter | None
|
|
`oauth_client_windows_authentications_failure_total` | Total number of failed OAuth Client Windows Integrated Authentications | counter | None
|
|
`oauth_client_windows_authentications_success_total` | Total number of successful OAuth Client Windows Integrated Authentications | counter | None
|
|
`oauth_logon_certificate_requests_failure_total` | Total number of failed OAuth Logon Certificate Requests | counter | None
|
|
`oauth_logon_certificate_token_requests_success_total` | Total number of successful RP tokens issued for OAuth Logon Certificate Requests | counter | None
|
|
`oauth_password_grant_requests_failure_total` | Total number of failed OAuth Password Grant Requests | counter | None
|
|
`oauth_password_grant_requests_success_total` | Total number of successful OAuth Password Grant Requests | counter | None
|
|
`oauth_token_requests_success_total` | Total number of successful RP tokens issued over OAuth protocol | counter | None
|
|
`samlp_token_requests_success_total` | Total number of successful RP tokens issued over SAML-P protocol | counter | None
|
|
`sso_authentications_failure_total` | Total number of failed SSO authentications | counter | None
|
|
`sso_authentications_success_total` | Total number of successful SSO authentications | counter | None
|
|
`wsfed_token_requests_success_total` | Total number of successful RP tokens issued over WS-Fed protocol | counter | None
|
|
`wstrust_token_requests_success_total` | Total number of successful RP tokens issued over WS-Trust protocol | counter | None
|
|
`userpassword_authentications_failure_total` | Total number of failed AD U/P authentications | counter | None
|
|
`userpassword_authentications_success_total` | Total number of successful AD U/P authentications | counter | None
|
|
`external_authentications_failure_total` | Total number of failed authentications from external MFA providers | counter | None
|
|
`external_authentications_success_total` | Total number of successful authentications from external MFA providers | counter | None
|
|
`db_artifact_failure_total` | Total number of failures connecting to the artifact database | counter | None
|
|
`db_artifact_query_time_seconds_total` | Accumulator of time taken for an artifact database query | counter | None
|
|
`db_config_failure_total` | Total number of failures connecting to the configuration database | counter | None
|
|
`db_config_query_time_seconds_total` | Accumulator of time taken for a configuration database query | counter | None
|
|
`federation_metadata_requests_total` | Total number of Federation Metadata requests | counter | None
|
|
|
|
### Example metric
|
|
Show rate of device authentications in AD FS:
|
|
```
|
|
rate(windows_adfs_device_authentications)[2m]
|
|
```
|
|
|
|
## Useful queries
|
|
|
|
|Query|Description|
|
|
|---|----|
|
|
|`rate(windows_adfs_oauth_password_grant_requests_failure_total[5m])`| Rate of OAuth requests failing due to bad client/resource values|
|
|
|`rate(windows_adfs_userpassword_authentications_failures_total[5m])`| Rate of `/adfs/oauth2/token/` requests failing due to bad username/password values (possible credential spraying)|
|
|
|
|
## Alerting examples
|
|
**prometheus.rules**
|
|
```yaml
|
|
- alert: "HighExtranetLockouts"
|
|
expr: "rate(windows_adfs_extranet_account_lockouts)[2m] > 100"
|
|
for: "10m"
|
|
labels:
|
|
severity: "high"
|
|
annotations:
|
|
summary: "High number of AD FS extranet lockouts"
|
|
description: "High number of AD FS extranet lockouts may indicate a password spray attack.\n Server: {{ $labels.instance }}\n Number of lockouts: {{ $value }}"
|
|
```
|