0

We have ADFS 3.0 running and we need to add another account partner (also running ADFs 3.0) for authenticating users. How can I accomplish this?

1 Answer 1

2

Which ADFS do you want to be the IDP?

That ADFS needs to be the Claims Provider, The other is the Relying Party.

Get each ADFS's metadata:

https://myADFS/FederationMetadata/2007-06/FederationMetadata.xml

and import when you are creating the CP / RP.

If you want either to be the IDP from both sides then you need to configure two relationships:

A as CP - B as RP and also

B as CP - A as RP

6
  • 1
    Thanks. I setup our ADFS server as the (RP) and the partner org's ADFS as (CP). Sharepoint 2013 is the app we are testing with. The user is prompted to authenticate but then is redirected between the CP and RP until ADFS generates the following error ID 364. Encountered error during federation passive request. Microsoft.IdentityServer.Web.InvalidRequestException: MSIS7042: The same client browser session has made '6' requests in the last '2' seconds. Contact your administrator for details. Any idea what would cause this?
    – Brandon
    Jun 10, 2015 at 21:52
  • Token lifetimes - samlman.wordpress.com/2015/03/01/…
    – rbrayb
    Jun 10, 2015 at 23:04
  • I followed this and setup the following timeouts however it is still causing the redirect loop. SharePoint (RP) LogonTokenCacheExpirationWindow : 00:08:00 ADFS1 (RP) TokenLifetime : 10 ADFS2 (CP) TokenLifetime : 10 Users in the home realm of ADFS1 are able to logon to sharepoint fine. However users in home realm ADFS2 get the redirect loop. Thanks for your help!
    – Brandon
    Jun 11, 2015 at 15:39
  • The token lifetime is by far the most common cause. Did you do a Get in PowerShell to confirm the changes? Others are no trailing slash on the URL, certificates, not in Trusted zone etc.
    – rbrayb
    Jun 11, 2015 at 19:01
  • 1
    I found the issue. I did not have pass through claim rules for sharepoint on the RP ADFS server. Thanks for the tips!
    – Brandon
    Jun 12, 2015 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .