The authorization flow I'm trying to determine the possibility of is:

  1. User goes to https://app.example.com/
  2. app.example.com does not have a session for the user so it sends them to https://adfs.example.com
  3. adfs.example.com does not have a session for the user
    • user does not have a session
      1. adfs.example.com acts as a SP and asks https://notadfsidp.example.com for authentication
      2. user has a session with notadfsidp so the are sent back to adfs as authenticated and in turn to app as authenticated
    • user has a session
      • user is redirected back to https://app.example.com as authenticated


I have a "portal" that uses CAS to authenticate users. Due to circumstances beyond my control, the CAS server captures the user's credentials on login so that they can be used for SSO to various services (this is the wrench in the works). One, or more, of the services they can SSO to are backed by a local ADFS instance. Thus, the ideal situation is that when they go to one of those services the ADFS server can learn from the CAS server that they are logged in and the portal would not have to use their stored credentials to authenticate them with ADFS.

If the flow described above is not possible, is it possible to send the ADFS server some message that tells it the user authenticated elsewhere and they should get a session with the ADFS server?

Note: my knowledge of SAML is very limited and I have zero knowledge of administering an ADFS server (that's a coworker).

Edit #1: I need the authentication to be transparent. In other words, after the user has authenticated at notadfsidp any visit to adfs from app would not require the user to do anything.

  • The user's HRD choice will be cached in cookies so the user will not need to choose IDP each time. Also you can use Work Place Join (another ADFS feature) for joining users devices into the organization. After configuring this, user will get SSO ability to your corp data & apps. More details can be found here:blogs.technet.microsoft.com/matthewms/2013/11/01/… – Jimmy Sun Mar 16 '17 at 3:16
  • @LongfeiSun-MSFT I can see how that would be an option for a corporation. However, what I didn't mention, which I thought might be implied by the CAS requirement, is that my organization is not a corporation but a university. We do not, or cannot, require people to join their devices to our domain. But if the HRD can be chosen automatically, even on first request, that would possibly solve my conundrum. – James Sumners Mar 16 '17 at 12:07
  • Actually WorkPlace join doesn't equal to domain join. Users just register their own devices (win8.1 or later) into your organization by adding their Work and School account. However the limitation is in this scenario only the user who registers the device can get SSO ability without choosing the HRD. – Jimmy Sun Mar 20 '17 at 5:10

The way this works in practice is via Home Realm Discovery.

https://notadfsidp.example.com is configured as a claims provider on https://adfs.example.com.

When a user navigates to https://app.example.com/ they are redirected to https://adfs.example.com, They then see the HRD screen where they choose https://notadfsidp.example.com as the IDP. They authenticate there.

Because the app. trusts adfs.example.com and that trusts notadfsidp.example.com, the user is now authenticated.

| improve this answer | |
  • So it wouldn't be transparent? – James Sumners Mar 15 '17 at 12:29
  • No - because you could have a situation where the ADFS has many CP and it cannot automatically decide which one you want to use. You can add parameters to the authentication request to say "Pick this one so no need for HRD". Are you using WS-Fed or SAML. – rbrayb Mar 15 '17 at 17:42
  • The adfs.example.com server is WS-Fed. – James Sumners Mar 15 '17 at 18:28
  • Scratch that. I'm being told it supports both WS-Fed and SAML. – James Sumners Mar 15 '17 at 18:35

Firstly, the https://notadfsidp.example.com should also be an ADFS server and it acts as an IDP actually in your scenario.

ADFS server https://adfs.example.com will not automatically ask the other ADFS server for authentication. Users should manually choose the IDP (or called Claim Provider in ADFS world) via the Home Realm Discovery feature like below.

After the authentication completes, the user token will be cached in the browser cookies and ADFS so that the user will get SSO ability when he/she accesses the app again.

enter image description here

| improve this answer | |
  • 2
    I don't see this as an answer. You are ignoring the central part of the question by saying notadfsidp should be an ADFS server. – James Sumners Mar 15 '17 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.