We have an web application that authenticates against Microsoft ADFS. We have seamless authentication activated. The problem is that some AD users (generic users) are not allowed to access this application. When users are logged in Windows with this generic not allowed user and they access to the application, they try to log with that user to the application and because it is not allowed they can access but neither are asked for other username and password.
I need to do a group in the AD where I would put these generic users and a GPO that disallow these users to try to log using seamless authentication in the ADFS.
We have tried to add these users to a group where the URL of this application is not trusted but this is not running properly with OpenID+OAuth that is what we are using.
- Person uses the username "somedepartment" (generic, not personal username) to log into Windows.
- Person tries to browse to https://intranet.company.com (we want that only personal users enters here).
As we use ADFS seamless authentication, browser tries to authenticate in https://intranet.company.com with username "somedepartment" but access is refused because we don't want generic usernames to enter here!! --> And this is OK BUT what I expected was that application after refusing access to the generic user asked me username and passwords to allow the user to enter his personal username and password but it does not happen.
- What can I do?
- Any ideas/hints?
- Can I do what I want?