Microsoft Active Directory Federation Service is an identity federation technology that provides single sign on access to web services and web applications using WS-* and SAML.

learn more… | top users | synonyms

6
votes
1answer
1k views

How can the x-frame-options HTTP header of ADFS 3 be manipulated?

By default, ADFS 3 responses contain the "X-Frame-Options: DENY" HTTP header. This prevents ADFS from being run in an iframe, because this presents an opportunity for clickjacking attacks. At the ...
1
vote
1answer
3k views

ADFS Relying Party - endpoint configuration

I'm working on setting up a lab environment with two Windows Server (virtual) machines that cooperate in an AD FS configuration. WIN-TORHJGJ7N: Windows Server 2012, running AD FS 2.0. Also the ...
0
votes
1answer
1k views

Issue connecting to AD FS configuration database

I just installed the AD FS role on my DC using the Windows Internal Database. All seemed to be fine after I set everything up, however, once I restarted my DC, when attempting to load the AD FS ...
4
votes
2answers
1k views

Windows Identity Foundation (WIF) application + ADFS 2.0 on Classic pipeline mode - Is it possible?

I have a working test application that uses Windows Idendity Foundation SDK and ADFS 2.0 for authentication, which runs on Windows Server 2008 R2, IIS 7.5, Integrated managed pipeline application pool ...
1
vote
1answer
1k views

ADFS 3.0 Microsoft.IdentityServer.RequestFailedException: MSIS7012:

could someone help me out with ADFS? this is my first time using it as i'm setting up Microsoft Dynamics. i get the following error message: Encountered error during federation passive request. ...
1
vote
1answer
67 views

“HTTP 503 - Service Unavailable” when trying to access ADFS password change page from an external network

I'm using ADFS 3.0 federated domain (SSO with Office-365) and I've successfully set up the password change page to work from any workplace joined device. I'm currently trying to set it up to be ...
0
votes
2answers
3k views

An error occurred while using SSL configuration for endpoint 0.0.0.0:443

Based on information received from the network team. I have determined that the issue most likely rests with the application servers on the WAN. After replacing the certificate, I ran the ...
0
votes
2answers
54 views

ADFS and relying party web form

We are in the process of configuring our ADFS server to allow SMAL authentication from a third party web application. We are slightly confused as listed below: We received metadata file and ...
0
votes
0answers
73 views

ADFS SSO w/ Chrome

I'm in need for some help with this one, despite going through many many KB around the web, I cannot figure this out: Chrome working with ADFS 2.0 keeps prompting for credentials and will not use ...
0
votes
0answers
12 views

ADFS SimpleSamlPHP - Missing SingleSignOn

We are integrating SimpleSamlPHP with ADFS. We have the federation Metadata with us. But the metadata xml doesn't have the SingleSignOnService Node in it. We have the SingleLogoutService option alone ...
0
votes
1answer
40 views

OWA error after the redirect from office365 login page

Before you read this article please mind that my english may not be perfect since it is not my main language. I have the following problem: When I want to login with my company e-mail I get ...
0
votes
0answers
17 views

Research ideas related to Distributed Single Sign on Systems(ADFS) ?

I'm going to do a research related to Security in Distributed Single Sign On system. Then i came up with the idea of implementing federated security using the LDAP and Kerberos as in following figure. ...
1
vote
1answer
15 views

How to get Subject from client certificate issued as a claim in ADFS?

I'm using Certificate Based Authentication in ADFS 3.0 and need to get the Subject field from the client certificate issued as a claim, but it's not available as an incoming claim to ADFS. When I ...
11
votes
2answers
17k views

What is ADFS (Active Directory Federation Services)?

So I've been told that our PHP application may need to support authentication using ADFS. For a non-Microsoft person, what is ADFS? How does it differ to things like LDAP? How does it work? What ...
0
votes
0answers
12 views

ADFS - Group claim fails for a particular user

For one user only, the group attribute name and values are not being sent to the service provider. All other attributes are sent, including givenname, surname, and emailaddress. Why might groups ...
1
vote
1answer
19 views

ADFS - How to be specific on a groups claim

How do you specify a particular set of groups to look for and return in the ADFS authentication rather than searching for and returning all a user's groups in the response message? This is a question ...
0
votes
1answer
24 views

AD FS Setting up - what user rights required?

I am reading this. Is this the latest? May I know what rights is required to set up and configure the Federation Server? Is the Federation Server usually the responsibility of the domain owner? If ...
0
votes
1answer
1k views

Mail clients for mobile devices for connecting to ADFS configured Office 365 mail

Any of you aware of any mail clients for mobile devices for connecting to Office 365 domains which are configured to single sign on through ADFS. Outlook.com client for android this doesnt seem to ...
3
votes
1answer
73 views

ADFS 3.0 Need Powershell command to remove Homelink

I am working on a Microsoft Windows Active Directory ADFS 3.0 (2012 R2 specifically) server. I was testing the Set-AdfsGlobalWebContent -Homelink and -Homelinktext options. I'd like to now ...
1
vote
1answer
617 views

AD FS 3.0 Event ID 364 while creating MFA (and SSO)

I have an clean installation of AD FS 3.0 installed on windows server 2012. I am trying to create MFA on my internal network using this Codeplex. AD FS Management > Authentication Policies ...
2
votes
1answer
2k views

ADFS SSO - LDAP Attributes as Claims - UPN as NameID - NameID Missing from SAML Response for users whose UPN is changed

ADFS SSO setup with Salesforce which uses UPN as NameID, has following configuration ADFS. Claim Rule Template: Send LDAP Attributes as Claims Claim Rule Name: Send the UPN as NameID LDAP ...
38
votes
6answers
9k views

If a Windows shop moves “everything” to the cloud, does it still need Active Directory?

Taking a spin off of this question: Do I really need MS Active Directory? in a new direction for 2014. Taking into account a basic Windows infrastructure: domain controllers Exchange 2007/2010/2013 ...
4
votes
2answers
997 views

Issue multiple claims in a single rule

Is there a simple way to issue multiple claims in a single ADFS Claim rule? The only example I can see is ones which query an attribute store, and each retrieved column is mapped to a different claim ...
3
votes
2answers
200 views

Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain

I'm using federated identity for Office-365 single sign-on. I have added the password change endpoint to my ADFS 3.0 server, and successfully opened the adfs update password page. However, whenever I ...
0
votes
0answers
2k views

ADFS 3.0 Service Unavailable in some circumstances

according to the blog How To Install ADFS (Part 1 + 2), I did setup a ADFS Server and a ADFS Proxy, both based on Windows Server 2012 R2. I can achieve the federationmetadata.xml page both from ...
0
votes
2answers
937 views

2 Domains - 1 ADFS - 1 SharePoint - 1 Authentication way

I'm wondering if this if possible: I have 1 AD Domain: InternalDomain. I want to create a secondary domain: CustomersDomain. I would like my SharePoint to be able to authenticate users from both ...
0
votes
1answer
224 views

Setup AD FS 3.0 Proxy when Primary AD FS Server is behind firewall

I am trying to setup an AD FS Proxy server. In my case, my AD FS Server is behind a network firewall and is accessible only within the intranet. I have spawned a DMZ machine and have set it up as a ...
1
vote
1answer
85 views

adfs proxy and dmz configuration

I am trying to setup an ADFS proxy in a DMZ as per Microsoft's best practices, but do not really understand how this is done practically. The basic premise is that a server is placed in the DMZ and ...
0
votes
0answers
75 views

Error occurred loading custom AD FS authentication provider on secondary AD FS server

We have a custom MFA provider for AD FS v3, and it's working nicely on the primary AD FS server. However, on the secondary, when AD FS starts, we get the following error in the event log: An error ...
4
votes
0answers
227 views

Signout with ADFS3 with SAML

I have implemented SSO using ADFS3. I have a logout button for sign out and it’s working fine with my ws-federation passive endpoints. On logout I redirect user to logout.aspx page and there I have ...
0
votes
1answer
33 views

Imitate Azure AD user/tenant claims within ADFS

I have a .Net web application that allows users to hook up their account with an identity provider (Azure AD, Google, and/or ADFS) to allow single sign-on. On hooking up their account (or ...
0
votes
2answers
69 views

ADFS and Shibboleth: Controlling behavior of Windows authentication

We are doing SSO using ADFS and Shibboleth SP. In a perfect world, Windows authentication would always work, i.e., the user accesses https://shibboleth/Login?target=somewhere, is redirected to ...
2
votes
1answer
96 views

AD FS Setup Issue on 2012 R2 Domain Controller

I am trying to run the Add-KdsRootKey command on a 2012 R2 domain controller for AD FS setup and am receiving the following error: Add-KdsRootKey : The specified domain either does not exist or could ...
1
vote
0answers
134 views

Working ADFS webapplication proxy. No SSO from webbroser to MSOFBA

We're implementing an WebApplication Proxy (WAP) on Windows server 2012R2 for our organisation to replace the authenticatin/SSO features of TMG. Currently we have a working WAP with SSO for: - ...
-1
votes
1answer
97 views

ADFS/SSO on a AWS EC2 Linux server [closed]

I have a website running on a AWS Linux EC2 instance with a Cpanel/WHM installation. Until now the website was protected by a single password, but I was asked to implement the company's Single Sign ...
0
votes
0answers
33 views

ADFS server allows non-domain login

How do I configure ADFS server to allow only login with domain? Currently my server allows both domain and non-domain. I have tried all options on configuration of ADFS, but nothing has changed. If ...
3
votes
1answer
6k views

SPN settings in a ADFS 3.0 lab setup

I am a developer trying to understand authentication with ADFS (2012 R2), so I am trying to setup an ADFS lab. I have found 2 guides: doc1 - http://technet.microsoft.com/en-us/library/dn280939.aspx ...
1
vote
0answers
35 views

AD FS Add Office 365 to Sites List / Limit Available Sites upon login [closed]

In AD FS there is a sites list that allows you to SAML in to other sites. Is it possible to make those not appear until you are signed in, then limit those only to services the user can access (for ...
1
vote
2answers
127 views

Error when creating a certificate using Windows SDK 7.1 Command Prompt

I am a new administrator with very little experience, trying to configure my ADFS to cooperate with a single sign-on solution to cloud-based help desk software to be used internally in my ...
0
votes
2answers
232 views

Using Shibboleth with ADFS doesn't work

I'm trying to familiarize myself with Shibboleth 2.5.3 and Active Directory Federation Services (tried both 2.0 and 3.0). What I'd like to achieve is having an Apache server authenticate against ADFS ...
2
votes
0answers
237 views

ADFS 3 WAP Pre-auth error 511 - 364

Very simple setup 2 adfs BE Servers and one proxy. Application name https://adfsapps.abc.local/ADFSApp1/ (basic Claims aware App). STS url is STS2.abc.local. If Application is published as Pass-Thru ...
0
votes
3answers
227 views

Where can you get an ADFS token signing certificate template

The topic says it all. Had anyone generated a self signed token signing cert from a template and where can you download a template (not a tool like makecert)? This is not the generic SSL cert, but a ...
0
votes
0answers
39 views

Error configuring Federation Server Proxy on an Azure Network

I have a Virtual Network on Azure where I have deployed a server(2012 R2 machine) as my AD FS Server and have put in an ACL which allows access to AD FS only through a few IP's in the network. I have ...
0
votes
2answers
198 views

Complex Exchange 2010 to Office 365 Migration with multiple domains

I keep going around in circles when trying to plan a migration from Exchange 2010 to Office 365 with conflicting information and different opinions to which is the best migration method for my ...
2
votes
1answer
27 views

Creating custom AD claims in ADFS v1.x

I'm sorry if this is an uneducated question, but I'm growing a bit desperate here. At work, we have a few customers that are still using ADFS versions prior to 2.0 which went the SAML2 route, and I'm ...
2
votes
1answer
341 views

Custom AD FS Rule for Office 365 MFA ActiveSync Exemption

We setup Office 365 with our RSA keys, and we are looking to exempt our mobile devices and outlook from MFA for now. From what I understand we have to form a custom issuance transform AD FS claim ...
0
votes
0answers
53 views

Does ADFS 3.0 support the ProviderName attribute in a SAML 2.0 Authnrequest?

We have a working SAML 2.0 integration working between ADFS 3.0 and another IdP, however we really need to be able to set the ProviderName attribute on the Authnrequest that is sent to the IdP. Is ...
2
votes
1answer
139 views

Office 365/ADFS Configuring aliases under different domains

We have Office 365 with ADFS for our domain (let's say domain.org) currently. We're considering converting about 150 users to it, all of whom currently have email via an Exchange server on a ...
0
votes
2answers
158 views

ADFS updatepassword portal rejects 50% of passwords with “NewPasswordHistConflict”

I'm seeing a strange problem with the ADFS updatepassword page. We're batch-creating users, and they are trying to change their passwords. However, roughly 50% of the accounts can't change their ...
-1
votes
1answer
131 views

ADFS 403 Error On login page

I just installed ADFS on my Windows Server 2012 and I am getting stuck. If I go to https://mail.mywebsi.te/adfs/ls I instantly get an 403 error without it actually showing the Default login screen. ...