Microsoft Active Directory Federation Service is an identity federation technology that provides single sign on access to web services and web applications using WS-* and SAML.

learn more… | top users | synonyms

1
vote
0answers
30 views
+50

“HTTP 503 - Service Unavailable” when trying to access ADFS password change page from an external network

I'm using ADFS 3.0 federated domain (SSO with Office-365) and I've successfully set up the password change page to work from any workplace joined device. I'm currently trying to set it up to be ...
3
votes
2answers
67 views

Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain

I'm using federated identity for Office-365 single sign-on. I have added the password change endpoint to my ADFS 3.0 server, and successfully opened the adfs update password page. However, whenever I ...
1
vote
1answer
92 views

AD FS 3.0 Event ID 364 while creating MFA (and SSO)

I have an clean installation of AD FS 3.0 installed on windows server 2012. I am trying to create MFA on my internal network using this Codeplex. AD FS Management > Authentication Policies ...
1
vote
1answer
41 views

adfs proxy and dmz configuration

I am trying to setup an ADFS proxy in a DMZ as per Microsoft's best practices, but do not really understand how this is done practically. The basic premise is that a server is placed in the DMZ and ...
0
votes
0answers
29 views

Error occurred loading custom AD FS authentication provider on secondary AD FS server

We have a custom MFA provider for AD FS v3, and it's working nicely on the primary AD FS server. However, on the secondary, when AD FS starts, we get the following error in the event log: An error ...
0
votes
1answer
23 views

Imitate Azure AD user/tenant claims within ADFS

I have a .Net web application that allows users to hook up their account with an identity provider (Azure AD, Google, and/or ADFS) to allow single sign-on. On hooking up their account (or ...
0
votes
2answers
27 views

ADFS and Shibboleth: Controlling behavior of Windows authentication

We are doing SSO using ADFS and Shibboleth SP. In a perfect world, Windows authentication would always work, i.e., the user accesses https://shibboleth/Login?target=somewhere, is redirected to ...
1
vote
1answer
50 views

AD FS Setup Issue on 2012 R2 Domain Controller

I am trying to run the Add-KdsRootKey command on a 2012 R2 domain controller for AD FS setup and am receiving the following error: Add-KdsRootKey : The specified domain either does not exist or could ...
1
vote
0answers
57 views

Working ADFS webapplication proxy. No SSO from webbroser to MSOFBA

We're implementing an WebApplication Proxy (WAP) on Windows server 2012R2 for our organisation to replace the authenticatin/SSO features of TMG. Currently we have a working WAP with SSO for: - ...
0
votes
0answers
25 views

ADFS server allows non-domain login

How do I configure ADFS server to allow only login with domain? Currently my server allows both domain and non-domain. I have tried all options on configuration of ADFS, but nothing has changed. If ...
1
vote
0answers
29 views

AD FS Add Office 365 to Sites List / Limit Available Sites upon login [closed]

In AD FS there is a sites list that allows you to SAML in to other sites. Is it possible to make those not appear until you are signed in, then limit those only to services the user can access (for ...
1
vote
2answers
112 views

Error when creating a certificate using Windows SDK 7.1 Command Prompt

I am a new administrator with very little experience, trying to configure my ADFS to cooperate with a single sign-on solution to cloud-based help desk software to be used internally in my ...
0
votes
1answer
57 views

ADFS/SSO on a AWS EC2 Linux server

I have a website running on a AWS Linux EC2 instance with a Cpanel/WHM installation. Until now the website was protected by a single password, but I was asked to implement the company's Single Sign ...
0
votes
2answers
91 views

Using Shibboleth with ADFS doesn't work

I'm trying to familiarize myself with Shibboleth 2.5.3 and Active Directory Federation Services (tried both 2.0 and 3.0). What I'd like to achieve is having an Apache server authenticate against ADFS ...
0
votes
1answer
81 views

Setup AD FS 3.0 Proxy when Primary AD FS Server is behind firewall

I am trying to setup an AD FS Proxy server. In my case, my AD FS Server is behind a network firewall and is accessible only within the intranet. I have spawned a DMZ machine and have set it up as a ...
2
votes
0answers
158 views

ADFS 3 WAP Pre-auth error 511 - 364

Very simple setup 2 adfs BE Servers and one proxy. Application name https://adfsapps.abc.local/ADFSApp1/ (basic Claims aware App). STS url is STS2.abc.local. If Application is published as Pass-Thru ...
0
votes
0answers
31 views

Error configuring Federation Server Proxy on an Azure Network

I have a Virtual Network on Azure where I have deployed a server(2012 R2 machine) as my AD FS Server and have put in an ACL which allows access to AD FS only through a few IP's in the network. I have ...
2
votes
1answer
20 views

Creating custom AD claims in ADFS v1.x

I'm sorry if this is an uneducated question, but I'm growing a bit desperate here. At work, we have a few customers that are still using ADFS versions prior to 2.0 which went the SAML2 route, and I'm ...
2
votes
1answer
174 views

Custom AD FS Rule for Office 365 MFA ActiveSync Exemption

We setup Office 365 with our RSA keys, and we are looking to exempt our mobile devices and outlook from MFA for now. From what I understand we have to form a custom issuance transform AD FS claim ...
0
votes
0answers
33 views

Does ADFS 3.0 support the ProviderName attribute in a SAML 2.0 Authnrequest?

We have a working SAML 2.0 integration working between ADFS 3.0 and another IdP, however we really need to be able to set the ProviderName attribute on the Authnrequest that is sent to the IdP. Is ...
2
votes
1answer
102 views

Office 365/ADFS Configuring aliases under different domains

We have Office 365 with ADFS for our domain (let's say domain.org) currently. We're considering converting about 150 users to it, all of whom currently have email via an Exchange server on a ...
-1
votes
1answer
78 views

ADFS 403 Error On login page

I just installed ADFS on my Windows Server 2012 and I am getting stuck. If I go to https://mail.mywebsi.te/adfs/ls I instantly get an 403 error without it actually showing the Default login screen. ...
0
votes
2answers
111 views

Complex Exchange 2010 to Office 365 Migration with multiple domains

I keep going around in circles when trying to plan a migration from Exchange 2010 to Office 365 with conflicting information and different opinions to which is the best migration method for my ...
0
votes
0answers
14 views

ADFS - Federated Web SSO - new partner wizard missing step for certificate selection

I am following technet article to implement a Federated Web SSO design. Steps here In step 4, last section (Import the Trey Research partner policy to A. Datum), I didn't get the chance to perform ...
0
votes
2answers
103 views

ADFS updatepassword portal rejects 50% of passwords with “NewPasswordHistConflict”

I'm seeing a strange problem with the ADFS updatepassword page. We're batch-creating users, and they are trying to change their passwords. However, roughly 50% of the accounts can't change their ...
0
votes
1answer
123 views

Exchange 2010 migration to Office 365 with ADFS

Let me first start off by explaining our environment. We have one AD domain - de***.co.uk Regardless of which department a user is in, every user authenticates with all systems (inc exchange) using ...
0
votes
1answer
194 views

How to customize change password page in ADFS 3.0 and find a list of available query strings?

Do you know how can I customize change password page? I want to change displayed warnings and add some information available only on this page. I know that MS provides description of the ...
0
votes
1answer
672 views

Issue connecting to AD FS configuration database

I just installed the AD FS role on my DC using the Windows Internal Database. All seemed to be fine after I set everything up, however, once I restarted my DC, when attempting to load the AD FS ...
0
votes
1answer
87 views

ADFS server is also Remote Desktop server - constant prompts HTTP 401 error

Our Remote Desktop server (2008 R2) is also hosting the IIS ADFS site. ADFS works beautifully for internal and external clients. Except, if I try to connect with a service that uses ADFS from the ...
1
vote
1answer
129 views

Getting Nested User groups in ADFS

Trying to get all of the groups and nested groups for a user when authentication with ADFS basically I have a structure like this group1 -> subgroup1, subgroup2 group2 - >subgroup3, subgroup2 ...
0
votes
1answer
380 views

ADFS on Windows Server 2012R2 in Azure sptting “Not a valid Win32 FileTime” exception on passive authentication

I'm receiving this error logged under ADFS Tracing - Debug: ServiceHostManager.LogFailedAuthenticationInfo: Token of type 'http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/UserName' ...
4
votes
0answers
169 views

Signout with ADFS3 with SAML

I have implemented SSO using ADFS3. I have a logout button for sign out and it’s working fine with my ws-federation passive endpoints. On logout I redirect user to logout.aspx page and there I have ...
3
votes
2answers
6k views

What is ADFS (Active Directory Federation Services)?

So I've been told that our PHP application may need to support authentication using ADFS. For a non-Microsoft person, what is ADFS? How does it differ to things like LDAP? How does it work? What ...
0
votes
1answer
116 views

Where is FsConfigWizard.exe on a fresh Windows Server 2012 R2 installation?

Having installed this service and realizing I'd configured the wizard incorrectly, I went to re-run it, and couldn't find it! Doing some searching on Bingle, I found various references to C:\Program ...
0
votes
3answers
137 views

Where can you get an ADFS token signing certificate template

The topic says it all. Had anyone generated a self signed token signing cert from a template and where can you download a template (not a tool like makecert)? This is not the generic SSL cert, but a ...
0
votes
1answer
141 views

Upgrade AD FS 1.0 on Win 2008 R2 to 2.0

Since AD FS 2.0 is available for Windows 2008 R2, can i simply upgrade AD FS 1.0 to 2.0 just by installing AD FS 2.0 or uninstalling AD FS 1.0 then installing AD FS 2.0. Or is this too risky? I wonder ...
0
votes
0answers
53 views

IIS website stops working after installing new certificate

We have an IIS website that is available at the URL acc.myapp.mycustomer.com. The myapp.mycustomer.com website shares the certification with the Sharepoint website. The site has been working fine for ...
0
votes
1answer
209 views

Is it possible for one Office365 tenant to have multiple IdP's?

We have a customer who wants their users to use different user accounts for SharePoint Online and Exchange/Office 365 mail (as weird as it sounds there is a legitimate reason for this). All the ...
0
votes
0answers
306 views

Exchange 2013 ADFS Authentication HTTP 500 Could not load type AdfsFederationAuthModule

I have been trying to configure ADFS claims authentication for Exchange 2013 SP1 CU9 on ECP and OWA. I keep running getting a 500.0 error when browsing to ECP or OWA. Server Error in '/ecp' ...
1
vote
1answer
612 views

Why is ADFS not passing credentials through with Integrated Windows Authentiation?

We have an ADFS 2.0 instance set up. We use it for 3rd party web app single sign-on. Everything works beautifully with the existing app, App1 with SAML 2.0, including IWA pass-through when users are ...
1
vote
2answers
364 views

Do I really need an account in domain\administrators for the Web Application Proxy with ADFS 3.0 on a domain controller?

I am trying to move my ADFS / WAP to the cloud to give better resilience after experiencing a recent failure. In part to save on VM costs, I am using just 2 VMs, with ADFS installed on a domain ...
3
votes
1answer
267 views

AD FS - Send AD Attributes to Shibboleth SP

I have an AD FS claims provider set up and a Shibboleth SP successfully authenticating against it. When I log into the site that's protected by Shibboleth, the index shows all of the headers. I am ...
0
votes
1answer
462 views

Sending AD Attributes as AD FS claims to Shibboleth SP Attributes

I have an AD FS claims provider set up and a Shibboleth SP successfully authenticating against it. I am attempting to have the Active Directory attributes sent to the SP. I followed this article to ...
5
votes
0answers
799 views

How can the x-frame-options HTTP header of ADFS 3 be manipulated?

By default, ADFS 3 responses contain the "X-Frame-Options: DENY" HTTP header. This prevents ADFS from being run in an iframe, because this presents an opportunity for clickjacking attacks. At the ...
0
votes
1answer
255 views

ADFS 3.0 How to Add an Account Partner?

We have ADFS 3.0 running and we need to add another account partner (also running ADFs 3.0) for authenticating users. How can I accomplish this?
0
votes
0answers
31 views

crm2013 adfs, 401 - unauthorized

Deployed crm2013 on prem linked that to an existing adfs instance (which is serving my crm2011 fine). However, in the Outlook CRM Clients I recieve this error: Discovery.svc Exception: ...
0
votes
2answers
150 views

Is it possible to delegate AD FS admin functions via a web interface? [closed]

I am looking at IAM for a SaaS application. The application will have client organisations accessing it and each organisation will want to manage their own users, permissions and roles. Of course only ...
1
vote
0answers
253 views

Integrated Auth working randomly with ADFS server

We have a working ADFS server that is allowing some users to authenticate to a SP through WIA, but some folks are being directed to the ADFS login page for the RPT. Users can then log in there and ...
0
votes
0answers
97 views

Accepting SAML token from third-party to allow access to our RDweb application

We have an RDweb hosted application, which until now has access control performed by a form and username/password authenticated against active directory. A third-party wishes to use their own ...
1
vote
1answer
68 views

Office 365 SSO presenting two signon boxes when using ADFS Proxies

I have the following setup- we use an external, third-party load balancer to forward traffic to one of our two ADFS Proxies (in the DMZ) which in turn forward to one of our two ADFS servers. ...