We have AD FS 3.0, working well. A new Relying Party Trust has been set up - again, it works well. However, there's a business (security) requirement for Same Sign-on rather than Single Sign-On, that is, we want the user to be required to enter their credentials each time for this Relying Party.
To do this, I've configured a Custom Primary Authentication Policy for this Relying Party, with the Users are required to provide credentials each time at sign in box ticked.
This doesn't seem to work - users are redirected from the third-party site to our Federation Server, but are then authenticated to the third-party site without being asked to enter their credentials.
Is there something obvious I've missed? What else should I check?