Microsoft Active Directory Federation Service is an identity federation technology that provides single sign on access to web services and web applications using WS-* and SAML.

learn more… | top users | synonyms

1
vote
1answer
1k views

ADFS SSO - LDAP Attributes as Claims - UPN as NameID - NameID Missing from SAML Response for users whose UPN is changed

ADFS SSO setup with Salesforce which uses UPN as NameID, has following configuration ADFS. Claim Rule Template: Send LDAP Attributes as Claims Claim Rule Name: Send the UPN as NameID LDAP ...
0
votes
0answers
110 views

adfs subdomain without prefix

I'm working at a company with an Active Directory installation. We have a Top level Domain with logins and a Sub-Domain, for customers, with more logins. We have setup Shibboleth as a service provider ...
1
vote
1answer
923 views

ADFS 2.0 SAML login works…but not for Domain Admins

We use a proxy service by zScaler. This has been setup so that there is an ADFS server between us and zScaler that authenticates the users and allows them access to the internet. This has been ...
0
votes
1answer
163 views

Multiple logins for separate hosts behind Web Application Proxy 2012

We're running SharePoint 2013 and allow external access via Microsoft's Web Application Proxy. When I connect to SharePoint from it, the profile images do not load because they are served up from the ...
2
votes
1answer
204 views

Access Installation Disc from Azure-hosted Windows Server 2012 R2 VM

I'm setting up an ADFS farm in Windows Azure and I need to export the settings of my old farm to import to the new farm. The official documentation on TechNet tells me to use scripts that are located ...
1
vote
0answers
335 views

IIS using ADFS/Saml to Authenticate

Does anyone know if there is a ADFS/SAML Identity Provider for IIS7? Example workflow - the user will go to the directory /private and it will redirect to the provider to login and back if the user ...
2
votes
1answer
3k views

SPN settings in a ADFS 3.0 lab setup

I am a developer trying to understand authentication with ADFS (2012 R2), so I am trying to setup an ADFS lab. I have found 2 guides: doc1 - http://technet.microsoft.com/en-us/library/dn280939.aspx ...
0
votes
1answer
2k views

What's the upgrade path for ADFS 2.1 to 3.0 (Server 2012 to 2012 R2)

I have several domain controllers running Windows Server 2012 with a domain and forest functional levels at Windows Server 2012. Two of the DCs are running ADFS (2.1) in a farm for users in my ...
0
votes
2answers
941 views

How do I create a custom ADFS 2nd factor sign in page?

I have a C# dll that provides HOTP and TOTP authentication. I'd like to adapt this for use with ADFS sign in pages. (I'll share this DLL with you if you like) How do I integrate my authentication ...
0
votes
1answer
81 views

Unable to update service communication certificate

We have added a self-signed certificate when setting up AD FS, and now want to update the service communications certificate to our domain's wildcard cert. Following these instructions: ...
6
votes
1answer
1k views

Support for refresh tokens in ADFS 2.2 OAuth flow

My colleague and I are trying to enable OAuth in ADFS 2.2. Everything is working except the server only passes back an access token (w/ expiration) and does not include a refresh token after ...
1
vote
1answer
491 views

What actions in Office 365 trigger requests for new SAML tokens?

We're in the process of diagnosing an issue where our on-premise ADFS servers stop accepting requests from the ADFS proxy servers for short (5m intervals). One behavior that we're having difficulty ...
32
votes
7answers
4k views

If a Windows shop moves “everything” to the cloud, does it still need Active Directory?

Taking a spin off of this question: Do I really need MS Active Directory? in a new direction for 2014. Taking into account a basic Windows infrastructure: domain controllers Exchange 2007/2010/2013 ...
1
vote
1answer
649 views

ADFS 2.0 Best Practices

I'm having a hard time finding some good articles on best practices for ADFS. We are looking to implement SSO for less than 200 users. We plan on setting up a federated server farm (2 servers) ...
0
votes
1answer
657 views

Setting up Windows Azure Pack with ADFS

I'm trying to setup the Windows Azure Pack Admin Site with Authentication from ADFS. I followed the given installation checklist from TechNet ...
1
vote
3answers
4k views

ADFS setup with Local AD and Azure AD without Dir Sync

I have local AD and AD on azure and I have ADFS and ADFS proxy server setup to authenticate users on local AD. I have followed all the steps on microsoft site to setup trust between Azure AD and local ...
3
votes
2answers
616 views

Send objectGUID as an AD FS 2.0 Claim

I would like to send objectGUID as a claim with AD FS 2.0 running on Windows Server 2012. I know I can create Issuance Transform Rules for a Relying Party Trust, but how does AD FS 2.0 know about ...
0
votes
1answer
109 views

Simple AD FS 3.0 external access

I'm setting up the ability for users to log in remotely to access web resources via AD FS 2.0 and Web Application Proxy. What I'm seeing right now is that when I attempt to log in remotely I initially ...
0
votes
1answer
368 views

Workplace Join (ADFS) On Windows Server Essentials 2012

I've got a domain hosted on Windows Server 2012 Essentials. I just bought a Surface 2, thinking that it would be easy peasy to join my domain and access all my files, clearly nothing is ever simple; ...
2
votes
1answer
249 views

Is it possible to pass SAML assertion depending upon attribute on User?

In Saleforce - ADFS SSO with AD being IdP. With AD 'Username' being SAML User Id; There are two type of users(standard users & portal users) in Salesforce. For SSO of portal users; SAML ...
3
votes
2answers
3k views

ADFSv2.1 redirect infinite loop

I'm trying to setup an ADFS server in a lab to test out the federation authentication mechanism. I'm following this guide: ...
1
vote
2answers
536 views

Office 365 migration: should I use ADFS?

Scenario: small company (<200 users), local Active Directory (single domain, 2008R2 level), on-premises deployment of Exchange 2010, Lync 2010 and SharePoint 2013. The company wants to go ...
0
votes
1answer
696 views

Mail clients for mobile devices for connecting to ADFS configured Office 365 mail

Any of you aware of any mail clients for mobile devices for connecting to Office 365 domains which are configured to single sign on through ADFS. Outlook.com client for android this doesnt seem to ...
0
votes
2answers
1k views

Are multiple ADFS instances needed when federating to the same party multiple times?

I'm currently in the first stages of an ADFS roll-out. It looks like you need to install multiple "federation services" or instances of ADFS if you want to federate with the same party or SaaS ...
0
votes
1answer
942 views

ADFS 2.1 proxy trust establishment error

I'm trying to install an ADFS proxy. In our intranet we have a ADFS 2.1 server running on Windows 2012 which is working fine. Now we're trying to deploy a proxy to this one for internet access, using ...
0
votes
1answer
2k views

How to install ADFS 3.0 in standalone mode?

I've installed Windows 2012 R2 and enabled the ADFS (3.0?) feature. After installation, it asks to configure ADFS, but this step requires a user account that is a domain administrator, as it wants to ...
2
votes
0answers
363 views

How to configure a different Saml2SecurityTokenHandler for passive federation in ADFS 2.0 .net 3.5

How do I configure an other Saml2SecurityTokenHandler (Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityTokenHandler) class for my passive federation on my ADFS 2.0 server? Right now: i'm trying ...
-5
votes
1answer
109 views

ADFS port with active directory [closed]

I have an ADFS server in DMZ and need it to talk to a DC. Which port does ADFS use to talk to a Domain controller in active directory? Thanks
3
votes
2answers
543 views

Does ADFS work with SSL offloading?

Does ADFS work with SSL offloading? Ive only seen ADFS with SSL certificates on the web servers, and we know it requires SSL. But does this requirement mean it must be all the way through to the ...
-1
votes
1answer
1k views

How to replace expiring Service Communication Certificates in ADFS 2.0

We have an ADFS 2.0 deployment which is used to provide claims-based authentication to our Dynamics CRM 2011 system. There are 2 ADFS servers in place. One is in the corporate user Active Directory ...
0
votes
1answer
187 views

Get list of all users Logging in ADFS 2.0

I wish to know if there is a way to get a list of all the users Logging in and out of ADFS 2.0. Is this possible. Regards
-1
votes
1answer
249 views

single sign on using active directory in asp.net

I have lot's of database, so for secure authentication I want to put single sign on using the concept of active directory. After reading of lot's of material i will try to install ADFS 2.0 But i ...
2
votes
1answer
1k views

Why is Kerberos security failing for our ADFS proxy server?

We have a WCF service that uses active federation to authenticate callers via AD FS 2.0 and it's working fine internally. Now we want to expose it to the outside world, so our server team set up a ...
2
votes
0answers
358 views

Using Dynamics CRM Outlook client for non-Active Directory users (Active federation with ws-trust)

I am experiencing challenges logging in to CRM from the Outlook client when the user does not reside in Active Directory. Some of our CRM users do not have Active Directory credentials. Instead they ...
0
votes
1answer
306 views

ADFS 2.0: send issuer of user certificate as claim

Using ADFS 2.0, I would like to send to a relying party information about the issuer of the user certificate, if a user authenticated using an x509 certificate. Is this possible? How should I ...
7
votes
2answers
3k views

Why can a user log in via more than one UPN

I've changed the for all users UPN suffix of a company from us.mycompany.local to mycompany.com in order to use claims aware applciations. In testing before the change I discovered that even if I ...
0
votes
3answers
358 views

Authenticating Clients against their own Active Directory

We are creating an application that will (hopefully) allow users to authenticate by multiple means. Either cloud-based services (google,facebook, etc.) or--hopefully--by their own company's Active ...
3
votes
1answer
2k views

ADFS SAML Single Logout

I'm dealing with a web application hooked up to ADFS as a relying party, for single sign on integration with a partner claims provider. It's all via SAML (not WS Federation.) The web app is .NET and ...
0
votes
1answer
461 views

Mobile compatible ADFS?

I'm deploying Dynamics CRM 2011 to my organization tomorrow and the only thing left bugging me is the mobile express experience. When the user enters the mobile URL for the CRM, they're first ...
0
votes
1answer
87 views

How to identify if ADFS 1 server is using WS-Fed?

I have a Windows 2003 server running ADFS 1 (SAML 1.1) and I'm trying to determine if this system is using WS-Fed. I do see <wsa:....> related items in the SAML communication both inbound and ...
0
votes
1answer
3k views

“The private key for the certificate that was configured could not be accessed.”

I'm trying (and failing) to replace the certificates for an ADFS 2.0 stand-alone installation. I've generated the certificates and placed them in the local machine store. But, no matter what I do, I ...
0
votes
1answer
276 views

Pass CRM 2011 Outlook authentication to Internet Explorer

Okay, so I have a Dynamics CRM 2011 environment running with IFD Configured. CRM is running Update Rollup 11, ADFS 2.0 has no Update Rollups installed. All servers in the environment are 2008R2. Our ...
0
votes
1answer
174 views

ADFS – newbie assistance

I’m a newbie in the ADFS 2.0 world and I want understand the basic assumptions of that technology. My goals is guarantee the access to our customer users to web application on our cloud environment. ...
2
votes
1answer
784 views

Using O365, ADFS, not using DirSync/FIM, what value should immutableId be for ADFS to assert right?

ADFS 2.0 asserts the immutableID value in its SAML assertion during Federation attempts with Office 365. The ImmutableId is specified at object create time in Office 365. If you use DirSync, the ...
1
vote
1answer
363 views

Can I use a single ADFS server for both office 365 and SharePoint SSO

Can I use a single ADFS server for both office 365 and SharePoint SSO if they use different SSL's and domain names? Enviroment consists of: 2 DC's -- ADFS Server -- ADFS Proxy -- Sharepoint 2010 ...
4
votes
1answer
870 views

Bulk update displayname attribute to match cn attribute for all AD groups

We are setting up ADFS for identity federation with a Microsoft Online service. The documentation states that "Groups without a displayname will NOT get synchronized..." We have over 250 groups that ...
1
vote
1answer
971 views

Office 365 SSO external DNS redirect

I have ADFS and office 365 completely set up and configured for SSO, using an ADFS server and ADFS proxy. For internal users, I have IIS configured on the adfs server to redirect companynamemail.com ...
0
votes
1answer
1k views

Server 2012, ADFS 2.1, and Office 365

Has anyone gotten ADFS 2.1 on Server 2012 working with o365 SSO? I have it working up to a point, I tweaked the registry to allow the powershell commands to run, user accounts syncs fine. Even the ...
3
votes
1answer
519 views

Issue multiple claims in a single rule

Is there a simple way to issue multiple claims in a single ADFS Claim rule? The only example I can see is ones which query an attribute store, and each retrieved column is mapped to a different claim ...
1
vote
2answers
4k views

ADFS 2.0 Proxy Server Vs. Opening ADFS Server to public

We are working on deploying ADFS for SSO with o365. We have a consulting firm that handles our firewall configuration. Today, while attempting to get them to set up a DMZ for me to install my ADFS ...