Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Having a bit of a problem getting Shibboleth (SSO) working with ADFS and Pound.

The main problem seems to be that:

  • The website address will be
  • Pound will then terminate the SSL and forward the traffic to the webserver on a different port (

I have set up Shibboleth to protect the address, which allows me to retrieve metadata and it all seems to be working fine. However the problem seems to be that ADFS is configured to protect the https website, so when Shibboleth attempts to recieve information from ADFS I get nothing except the following error:

A token request was received for a relying party identified by the key 
'', but the request could not 
be fulfilled because the key does not identify any known relying party trust. 

I am not really sure how I can work around this as to retrieve the metadata from Shibboleth I have to use the https address but this does not actually exist in Shibboleth or IIS.

Has anyone had any experience with this before or using any other SSO with a reverse proxy that works?

share|improve this question

You need to look at the RP trust configured on the AD FS server for Shibboleth. Make sure you have the correct identifier for Shibboleth SP configured on AD FS. Note that this is a URI and its case sensitive.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.