We have an web application that authenticates against Microsoft ADFS. We have seamless authentication activated. The problem is that some AD users (generic users) are not allowed to access this application. When users are logged in Windows with this generic not allowed user and they access to the application, they try to log with that user to the application and because it is not allowed they can access but neither are asked for other username and password.

I need to do a group in the AD where I would put these generic users and a GPO that disallow these users to try to log using seamless authentication in the ADFS.

We have tried to add these users to a group where the URL of this application is not trusted but this is not running properly with OpenID+OAuth that is what we are using.


  1. Person uses the username "somedepartment" (generic, not personal username) to log into Windows.
  2. Person tries to browse to https://intranet.company.com (we want that only personal users enters here).
  3. As we use ADFS seamless authentication, browser tries to authenticate in https://intranet.company.com with username "somedepartment" but access is refused because we don't want generic usernames to enter here!! --> And this is OK BUT what I expected was that application after refusing access to the generic user asked me username and passwords to allow the user to enter his personal username and password but it does not happen.

    • What can I do?
    • Any ideas/hints?
    • Can I do what I want?

migrated from superuser.com Oct 17 '18 at 11:06

This question came from our site for computer enthusiasts and power users.

  • I am not sure if I understand your question - You are using a (correctly) working ADFS, but you do not want to use ... ADFS? – bjoster Oct 17 '18 at 15:28
  • @bjoster I don't want to use seamless authentication (one functionality of ADFS. It has more functionalities) for some specific users for some specific applications. I think it is a legitimate need. – Eloy Roldán Paredes Oct 17 '18 at 16:51
  • 1
    Sounds a bit strange to me, but you can configure arbitrary rules for incoming claims in your FS relaying party trust. In this case in ADFSmc, under TrustRelationsships, just add a claim with a rule "Permit or Deny Users Based on an Incoming Claim" and set the "Incoming Group claim" to the SID of your Accessing-but-should-not-have-access-group (with 'deny' as Option). That would effectively block your user(s) - but what your application does (asking for new credentils or just block access) is beyond the scope of ADFS. – bjoster Oct 18 '18 at 12:54

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.