Microsoft Active Directory Federation Service is an identity federation technology that provides single sign on access to web services and web applications using WS-* and SAML.

learn more… | top users | synonyms

0
votes
1answer
7 views

ADFS claim rule to get all users in a group

I am trying to create a claim rule to return all usernames in a group when I authenticate to the ADFS server. Currently I have claim rules setup to return the username of the person who logged in, ...
0
votes
1answer
17 views

is ad fs for internal crm necessary if we already have an sso for internet facing services?

I never had to deal with AD FS until now so not sure if i get it correctly. We will have an implementation of Dynamic CRM inside our network soon and we already use F5 Big-IP APM for sso with other ...
0
votes
2answers
37 views

Steps for troubleshooting Windows ADFS issue

Yesterday I posted a specific question about an error I'm getting in ADFS that has me stumped. Because I have very limited experience troubleshooting windows based products, I think advice on how to ...
0
votes
1answer
78 views

ADFS error duing SAML Service Provider Login

I have a Spring SAML Project that has been under development for about a month. I've integrated with ADFS and everything has been working well. I'm getting an intermittent error that is becoming ...
0
votes
1answer
12 views

Should I worry about outages upon auto-rollover of ADFS token certificates?

As far as I understand ADFS self-manages the token signing and decryption certificates unless configured otherwise so in my current situation (see attached picture) there should be no need to do ...
0
votes
0answers
20 views

Can I perform delegation for azure cloud with wildcard domain certificate or i need a server sertificate?

I currently have a windows adfs server installed locally with wildcard domain certificate. I am planning to setup Azure Cloud ADFS with a sub-domain of the wildcard domain certificate that i own. ...
0
votes
0answers
35 views

List of well known Claim Type

I'm building a single sign-on service using ADFS. I can't find a complete list of claim types (Ex: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier). There are some ...
2
votes
1answer
41 views

Azure Active Directory with On-Premises Dynamic CRM

I already had this infra working. On Premises: MS Dynamic CRM IFD + ADFS + ADDS On Cloud: Azure AD My problem is now we can only create account in on-premises and sync to AAD once the Azure ...
0
votes
0answers
19 views

ADFS SimpleSamlPHP - Missing SingleSignOn

We are integrating SimpleSamlPHP with ADFS. We have the federation Metadata with us. But the metadata xml doesn't have the SingleSignOnService Node in it. We have the SingleLogoutService option alone ...
0
votes
0answers
19 views

Research ideas related to Distributed Single Sign on Systems(ADFS) ?

I'm going to do a research related to Security in Distributed Single Sign On system. Then i came up with the idea of implementing federated security using the LDAP and Kerberos as in following figure. ...
1
vote
1answer
49 views

How to get Subject from client certificate issued as a claim in ADFS?

I'm using Certificate Based Authentication in ADFS 3.0 and need to get the Subject field from the client certificate issued as a claim, but it's not available as an incoming claim to ADFS. When I ...
0
votes
0answers
17 views

ADFS - Group claim fails for a particular user

For one user only, the group attribute name and values are not being sent to the service provider. All other attributes are sent, including givenname, surname, and emailaddress. Why might groups ...
1
vote
1answer
36 views

ADFS - How to be specific on a groups claim

How do you specify a particular set of groups to look for and return in the ADFS authentication rather than searching for and returning all a user's groups in the response message? This is a question ...
0
votes
1answer
98 views

OWA error after the redirect from office365 login page

Before you read this article please mind that my english may not be perfect since it is not my main language. I have the following problem: When I want to login with my company e-mail I get ...
0
votes
0answers
156 views

ADFS SSO w/ Chrome

I'm in need for some help with this one, despite going through many many KB around the web, I cannot figure this out: Chrome working with ADFS 2.0 keeps prompting for credentials and will not use ...
0
votes
1answer
32 views

AD FS Setting up - what user rights required?

I am reading this. Is this the latest? May I know what rights is required to set up and configure the Federation Server? Is the Federation Server usually the responsibility of the domain owner? If ...
0
votes
2answers
69 views

ADFS and relying party web form

We are in the process of configuring our ADFS server to allow SMAL authentication from a third party web application. We are slightly confused as listed below: We received metadata file and ...
3
votes
1answer
98 views

ADFS 3.0 Need Powershell command to remove Homelink

I am working on a Microsoft Windows Active Directory ADFS 3.0 (2012 R2 specifically) server. I was testing the Set-AdfsGlobalWebContent -Homelink and -Homelinktext options. I'd like to now remove/...
1
vote
1answer
98 views

“HTTP 503 - Service Unavailable” when trying to access ADFS password change page from an external network

I'm using ADFS 3.0 federated domain (SSO with Office-365) and I've successfully set up the password change page to work from any workplace joined device. I'm currently trying to set it up to be ...
3
votes
2answers
426 views

Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain

I'm using federated identity for Office-365 single sign-on. I have added the password change endpoint to my ADFS 3.0 server, and successfully opened the adfs update password page. However, whenever I ...
1
vote
1answer
1k views

AD FS 3.0 Event ID 364 while creating MFA (and SSO)

I have an clean installation of AD FS 3.0 installed on windows server 2012. I am trying to create MFA on my internal network using this Codeplex. AD FS Management > Authentication Policies Multi-...
1
vote
1answer
156 views

adfs proxy and dmz configuration

I am trying to setup an ADFS proxy in a DMZ as per Microsoft's best practices, but do not really understand how this is done practically. The basic premise is that a server is placed in the DMZ and ...
0
votes
0answers
107 views

Error occurred loading custom AD FS authentication provider on secondary AD FS server

We have a custom MFA provider for AD FS v3, and it's working nicely on the primary AD FS server. However, on the secondary, when AD FS starts, we get the following error in the event log: An error ...
0
votes
1answer
40 views

Imitate Azure AD user/tenant claims within ADFS

I have a .Net web application that allows users to hook up their account with an identity provider (Azure AD, Google, and/or ADFS) to allow single sign-on. On hooking up their account (or "on-...
0
votes
2answers
104 views

ADFS and Shibboleth: Controlling behavior of Windows authentication

We are doing SSO using ADFS and Shibboleth SP. In a perfect world, Windows authentication would always work, i.e., the user accesses https://shibboleth/Login?target=somewhere, is redirected to https:/...
2
votes
1answer
138 views

AD FS Setup Issue on 2012 R2 Domain Controller

I am trying to run the Add-KdsRootKey command on a 2012 R2 domain controller for AD FS setup and am receiving the following error: Add-KdsRootKey : The specified domain either does not exist or could ...
1
vote
0answers
177 views

Working ADFS webapplication proxy. No SSO from webbroser to MSOFBA

We're implementing an WebApplication Proxy (WAP) on Windows server 2012R2 for our organisation to replace the authenticatin/SSO features of TMG. Currently we have a working WAP with SSO for: - ...
0
votes
0answers
36 views

ADFS server allows non-domain login

How do I configure ADFS server to allow only login with domain? Currently my server allows both domain and non-domain. I have tried all options on configuration of ADFS, but nothing has changed. If ...
1
vote
0answers
41 views

AD FS Add Office 365 to Sites List / Limit Available Sites upon login [closed]

In AD FS there is a sites list that allows you to SAML in to other sites. Is it possible to make those not appear until you are signed in, then limit those only to services the user can access (for ...
1
vote
2answers
147 views

Error when creating a certificate using Windows SDK 7.1 Command Prompt

I am a new administrator with very little experience, trying to configure my ADFS to cooperate with a single sign-on solution to cloud-based help desk software to be used internally in my organization....
-1
votes
1answer
131 views

ADFS/SSO on a AWS EC2 Linux server [closed]

I have a website running on a AWS Linux EC2 instance with a Cpanel/WHM installation. Until now the website was protected by a single password, but I was asked to implement the company's Single Sign ...
1
vote
2answers
445 views

Using Shibboleth with ADFS doesn't work

I'm trying to familiarize myself with Shibboleth 2.5.3 and Active Directory Federation Services (tried both 2.0 and 3.0). What I'd like to achieve is having an Apache server authenticate against ADFS ...
0
votes
1answer
351 views

Setup AD FS 3.0 Proxy when Primary AD FS Server is behind firewall

I am trying to setup an AD FS Proxy server. In my case, my AD FS Server is behind a network firewall and is accessible only within the intranet. I have spawned a DMZ machine and have set it up as a ...
2
votes
0answers
274 views

ADFS 3 WAP Pre-auth error 511 - 364

Very simple setup 2 adfs BE Servers and one proxy. Application name https://adfsapps.abc.local/ADFSApp1/ (basic Claims aware App). STS url is STS2.abc.local. If Application is published as Pass-Thru ...
0
votes
0answers
43 views

Error configuring Federation Server Proxy on an Azure Network

I have a Virtual Network on Azure where I have deployed a server(2012 R2 machine) as my AD FS Server and have put in an ACL which allows access to AD FS only through a few IP's in the network. I have ...
2
votes
1answer
30 views

Creating custom AD claims in ADFS v1.x

I'm sorry if this is an uneducated question, but I'm growing a bit desperate here. At work, we have a few customers that are still using ADFS versions prior to 2.0 which went the SAML2 route, and I'm ...
2
votes
1answer
454 views

Custom AD FS Rule for Office 365 MFA ActiveSync Exemption

We setup Office 365 with our RSA keys, and we are looking to exempt our mobile devices and outlook from MFA for now. From what I understand we have to form a custom issuance transform AD FS claim ...
0
votes
0answers
69 views

Does ADFS 3.0 support the ProviderName attribute in a SAML 2.0 Authnrequest?

We have a working SAML 2.0 integration working between ADFS 3.0 and another IdP, however we really need to be able to set the ProviderName attribute on the Authnrequest that is sent to the IdP. Is ...
2
votes
1answer
181 views

Office 365/ADFS Configuring aliases under different domains

We have Office 365 with ADFS for our domain (let's say domain.org) currently. We're considering converting about 150 users to it, all of whom currently have email via an Exchange server on a ...
-1
votes
1answer
169 views

ADFS 403 Error On login page

I just installed ADFS on my Windows Server 2012 and I am getting stuck. If I go to https://mail.mywebsi.te/adfs/ls I instantly get an 403 error without it actually showing the Default login screen. ...
0
votes
2answers
294 views

Complex Exchange 2010 to Office 365 Migration with multiple domains

I keep going around in circles when trying to plan a migration from Exchange 2010 to Office 365 with conflicting information and different opinions to which is the best migration method for my ...
0
votes
0answers
21 views

ADFS - Federated Web SSO - new partner wizard missing step for certificate selection

I am following technet article to implement a Federated Web SSO design. Steps here In step 4, last section (Import the Trey Research partner policy to A. Datum), I didn't get the chance to perform ...
0
votes
2answers
199 views

ADFS updatepassword portal rejects 50% of passwords with “NewPasswordHistConflict”

I'm seeing a strange problem with the ADFS updatepassword page. We're batch-creating users, and they are trying to change their passwords. However, roughly 50% of the accounts can't change their ...
0
votes
1answer
235 views

Exchange 2010 migration to Office 365 with ADFS

Let me first start off by explaining our environment. We have one AD domain - de***.co.uk Regardless of which department a user is in, every user authenticates with all systems (inc exchange) using ...
0
votes
1answer
610 views

How to customize change password page in ADFS 3.0 and find a list of available query strings?

Do you know how can I customize change password page? I want to change displayed warnings and add some information available only on this page. I know that MS provides description of the ...
0
votes
1answer
2k views

Issue connecting to AD FS configuration database

I just installed the AD FS role on my DC using the Windows Internal Database. All seemed to be fine after I set everything up, however, once I restarted my DC, when attempting to load the AD FS ...
0
votes
1answer
137 views

ADFS server is also Remote Desktop server - constant prompts HTTP 401 error

Our Remote Desktop server (2008 R2) is also hosting the IIS ADFS site. ADFS works beautifully for internal and external clients. Except, if I try to connect with a service that uses ADFS from the ...
1
vote
1answer
357 views

Getting Nested User groups in ADFS

Trying to get all of the groups and nested groups for a user when authentication with ADFS basically I have a structure like this group1 -> subgroup1, subgroup2 group2 - >subgroup3, subgroup2 ...
0
votes
1answer
712 views

ADFS on Windows Server 2012R2 in Azure sptting “Not a valid Win32 FileTime” exception on passive authentication

I'm receiving this error logged under ADFS Tracing - Debug: ServiceHostManager.LogFailedAuthenticationInfo: Token of type 'http://schemas.microsoft.com/ws/2006/05/identitymodel/tokens/UserName' ...
4
votes
0answers
252 views

Signout with ADFS3 with SAML

I have implemented SSO using ADFS3. I have a logout button for sign out and it’s working fine with my ws-federation passive endpoints. On logout I redirect user to logout.aspx page and there I have ...