We've done SAML-based SP-initiated SSO with a number of customers, and it's all been ok (eventually).
We've got a customer now who's using ADFS. We can get idP-initiated to work fine, but with SP-initiated they get an error:
Exception details: Microsoft.IdentityServer.Web.InvalidScopeException: MSIS7007: The requested relying party trust '[BASE-URI]' is unspecified or unsupported. If a relying party trust was specified, it is possible that you do not have permission to access the trust relying party. Contact your administrator for details. at Microsoft.IdentityServer.Web.Protocols.Saml.SamlSignInContext.Validate() at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.GetRequiredPipelineBehaviors(ProtocolContext pContext) at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)
I'm not at all familiar with ADFS. Googling said we need a relying trust URL, so I found an example online and after some C&P, here's mine: trust.xml. The ADFS config was updated with the URL for this file.
This doesn't seem to make any difference, which makes me think one of the following:
- The ADFS configuration isn't right
- The trust.xml file isn't right, so ADFS isn't getting what it needs
- Something else that I'm not even aware of
Any pointers / suggestions would be gratefully received.