We have ADFS 3.0 running and we need to add another account partner (also running ADFs 3.0) for authenticating users. How can I accomplish this?
1 Answer
Which ADFS do you want to be the IDP?
That ADFS needs to be the Claims Provider, The other is the Relying Party.
Get each ADFS's metadata:
https://myADFS/FederationMetadata/2007-06/FederationMetadata.xml
and import when you are creating the CP / RP.
If you want either to be the IDP from both sides then you need to configure two relationships:
A as CP - B as RP and also
B as CP - A as RP
-
1Thanks. I setup our ADFS server as the (RP) and the partner org's ADFS as (CP). Sharepoint 2013 is the app we are testing with. The user is prompted to authenticate but then is redirected between the CP and RP until ADFS generates the following error ID 364. Encountered error during federation passive request. Microsoft.IdentityServer.Web.InvalidRequestException: MSIS7042: The same client browser session has made '6' requests in the last '2' seconds. Contact your administrator for details. Any idea what would cause this?– BrandonJun 10, 2015 at 21:52
-
-
I followed this and setup the following timeouts however it is still causing the redirect loop. SharePoint (RP) LogonTokenCacheExpirationWindow : 00:08:00 ADFS1 (RP) TokenLifetime : 10 ADFS2 (CP) TokenLifetime : 10 Users in the home realm of ADFS1 are able to logon to sharepoint fine. However users in home realm ADFS2 get the redirect loop. Thanks for your help!– BrandonJun 11, 2015 at 15:39
-
The token lifetime is by far the most common cause. Did you do a Get in PowerShell to confirm the changes? Others are no trailing slash on the URL, certificates, not in Trusted zone etc.– rbraybJun 11, 2015 at 19:01
-
1I found the issue. I did not have pass through claim rules for sharepoint on the RP ADFS server. Thanks for the tips!– BrandonJun 12, 2015 at 16:27