Questions tagged [adfs]
Microsoft Active Directory Federation Service is an identity federation technology that provides single sign on access to web services and web applications using WS-* and SAML.
363
questions
0
votes
0
answers
36
views
ADFS2 secondary server not listening on port 443
Our monitoring sensor connection for https 443 to our secondary ADFS server is refused.
We recently renewed theADFS SSL certificate, and since the secondary server is not listening on port 443.
All ...
0
votes
0
answers
316
views
ADFS Web Application proxy 2016 errors
I have a Domain Controller(Windows server 2016) and installed ADFS on another machine(Windows Server 2016) on the same domain. I can access the IDP signon page in the domain machines internally. Now, ...
0
votes
0
answers
21
views
Can ADFS present one IDP to SAML SP, but authenticate against multiple AD servers on the back end?
Summary
Can ADFS present one IDP to a SAML Service Provider (SP), but authenticate against multiple AD servers on the back end?
Context
Here's the usecase:
Company Foo has bought company Bar
They ...
- 315
0
votes
1
answer
490
views
ADFS Client Certificate Authentication
I have ADFS on my environment and it's currently authenticating via active directory perfectly fine. I'm trying to enable certificate authentication so they can authenticate with their smart cards. ...
- 1
1
vote
0
answers
39
views
Switching from ADFS to password sync, how to check dependencies
Is there a way to check if there is any dependencies on swichting from ADFS => PHS?
We are doing migration of another company into ours, and in that regard want to get rid of their ADFS.
...
0
votes
0
answers
80
views
AD FS SP forcing custom AuthnRequest
AD FS Error:
Exception details: Microsoft.IdentityServer.Service.Policy.PolicyServer.Engine.UnknownAuthenticationTypePolicyException: MSIS3305: None of the AuthenticationContext class references ...
- 1
0
votes
0
answers
46
views
TransientServiceErrorException trying to call Update-MsolFederatedDomain
I am trying to migrate from an older 2012 R2 server with ADFS to a newer 2019 ADFS farm.
Years ago, I followed the MS guides to federate with Office 365, and it has been working fine with the older ...
- 525
1
vote
0
answers
89
views
Implement SSO between a custom app and Microsoft 365 with custom identity provider
I’m trying to implement SSO between a custom app and Microsoft 365 so that when the users hit any link to Teams o SharePoint Online in the Liferay app, ADFS doesn't ask for credentials. Context:
ADFS ...
0
votes
0
answers
72
views
ADFS Claims Provider not receiving username/email
I have an on-prem ADFS setup as below with SAML2,
SP <=> ADFS <=> IDP
When the SP initiates an authentication, the client can redirect to the IDP (configured as a Claims Provider) and ...
- 111
0
votes
0
answers
56
views
SSO for website for external domain
A client would like to set up SSO from their domain to my hosted website. They have suggested using ADFS. I have a single server hosting ADUC, ADFS and IIS in, let's say, fs.mydomain.com which is ...
0
votes
0
answers
31
views
ADFS and ColdFusion setup regarding certificate
I am so confused about this certification involvement between CF and ADFS talk. When we click on "Generate SP" on ColdFusion administrator, it does create a .p12 file but on the ADFS side, ...
user282823
0
votes
1
answer
903
views
Setting up OIDC with ADFS - Invalid UserInfo Request
Background
So I've been pulling my hair out the past few weeks trying to get OIDC authentication working based on ADFS in various applications, specifically Proxmox VE as well as Gitea. The reason why ...
2
votes
0
answers
583
views
Single Sign on (SSO) not working on Firefox
Could it be that Firefox doesn’t support all windows NTLM SSO scenarios on a Sharepoint Site via adfs? Login attempts into Sharepoint site just gets stuck on the login page and nothing happens ...
- 51
0
votes
0
answers
80
views
EnableIdpInitiatedsignon Page unavailable in ADFS 3.0
I have a Windows Server 2012 R2 datacenter machine with that I created the Active Directory Federation Server Environment. After completing the installation and configuration, I tried enabling the ...
0
votes
0
answers
209
views
How do I configure on-prem ADFS for login to Grafana?
I am looking for a precise enough guide on how to configure ADFS login (service provider (SP) initiated logins) to Grafana. I have a Prometheus-Loki-Grafana instance running in K8s and Grafana can be ...
- 123
-3
votes
1
answer
891
views
My customer wanted to implement SSO on their ADFS environment and it shows them the below error. Is there any troubleshooting steps?
MSIS7007: The requested relying party trust 'https://domain/name/sso/saml' is unspecified or unsupported. If a relying party trust was specified, it is possible that you do not have permission to ...
1
vote
2
answers
1k
views
How do I manually circumvent the AD FS certificate catch-22
I can't start AD FS service. This is because it's configured with a certificate with an incorrect set of unnecessarily overcomplicated X509 extensions. This causes the service to fail with error 102, ...
- 119
1
vote
1
answer
519
views
ADFS. Third Party True Claim Rule needed to return `domain\user`
I have configured Claims Provider Trust in ADFS and I am getting only Email in NameID. I can not make changes to Third party Claims Provider Trust, so I have to get WindowsAccountName using the Email ...
- 211
1
vote
1
answer
173
views
Does Windows SSO work with ADFS 2016 for OIDC Web Application?
Our web application uses OpenID-Connect (OIDC) Implicit Flow for user login with ADFS 2016. Login generally works, however users get login screen for user name and password.
Does Windows-Login / SSO (...
0
votes
2
answers
206
views
ADFS as proxy to some IDP
As far as I know, Exchange does support WS-Federation, but it does not support SAML. At the same time I have IDP that does support SAML, but does not support WS-Federation.
Is it possible to configure ...
- 145
0
votes
2
answers
2k
views
Connection reset for HTTPS on ADFS
I have set up a windows server in virtual box with host only network as a labenvironment. I have a problem accessing HTTPS from the host only network.
I have set up a domain controller and ADFS on a ...
- 111
1
vote
0
answers
324
views
Revoked certificate not getting into Microsoft CA CRL
I have a CA and an Active Directory + ADFS instances set up on a Windows Server 2016 machine. I issued a client certificate for one of the users (for smart card logon) and then revoked it. However, I'...
- 11
0
votes
1
answer
214
views
Can't setup AD FS with SimpleSAMLphp, where do I get the metadata?
I'm following this article to setup AD FS SSO with PHP: https://stratbeans.medium.com/how-to-integrate-active-directory-in-php-application-for-sso-22eb62b6b866
I've successfully setup nginx + php-fpm ...
- 747
0
votes
1
answer
388
views
Domain joined WAP in DMZ
To date, I've only ever used ADFS for claims aware applications.
I'm now looking at using it for some non-claims aware applications.
I've read that the WAP server must be domain joined for this so ...
- 1
0
votes
1
answer
2k
views
SAML 2.0 NameIDPolicy that was not satisfied by the issued token
I am working on a SAML integration with some monitoring software, but I keep receiving the MSIS7070 error below. I have tried numerous transform combinations with no luck. I am certain this is ...
- 111
0
votes
1
answer
2k
views
ADFS: Some Users Cannot Sign-In
I have a new ADFS implementation running on Server 2019. After setup, I tested authentication for various user accounts using the /adfs/ls/IdpInitiatedSignon.aspx. Most of the account I tested worked ...
- 61
0
votes
1
answer
83
views
Migrating from Azure AD SSO authentication to ADFS
We are having a customer with the following setup.
onPrem Active Directory with Azure AD Connect and Password Hash Sync (PHS) including SSO activation
SSO for all M365 apps
Integration of about 15 ...
- 1
0
votes
2
answers
176
views
How do I convert a multi-value SAML attribute to a single-value string in ADFS?
I previously asked a similar question about doing this in Azure AD. However, I've come to the conclusion that it is probably too limited to do this and I received no answers.
However, in ADFS there is ...
- 3,448
0
votes
1
answer
105
views
Azure - ADFS internal load balancer. Is this required when using WID?
MY understanding of using WID is only one server is the primary ADFS and this has write access to the DB only. Therefore, why is an internal load balancer required? The fail over is a manual process. ...
1
vote
1
answer
1k
views
MS RRAS + MS VPN Client + Google Authenticator + SecureMFA
I'm running on-premise Windows Server 2019 domain, and Microsoft RRAS to allow remote users access to the local network. Remote users are using the built-in Microsoft VPN SSTP for Windows 10 clients ...
- 11
1
vote
2
answers
798
views
Cross Domain Authentication with ADFS (no domain trust)
Yesterday I was asked whether it is possible to establish a cross domain authentication with ADFS.
Scenario:
Two different Windows Domains (A & B) without any trust configuration
Network access ...
- 11
1
vote
0
answers
32
views
Windows ADFS User Certificate URL
I have setup a window lab server based on windows server 2012 r2. I have an AD, ADFS and CS.
I have setup User certificate enrollment. Everything work fine but I have a litle issue.
I have setup ADFS ...
1
vote
0
answers
2k
views
ADFS error: Failed to register SSL bindings for Device Registration Service: An item with the same key has already been added
I'm running Windows Server 2016 Active Passive ADFS server, the primary ADFS server ADFS01-VM has been set up fine using the steps in https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/...
- 1,255
1
vote
0
answers
989
views
Get specific user information like email, firstname, etc other than sub attribute from userinfo endpoint of ADFS 2016
I am trying to authenticate the user with ADFS is identity provider and liferay is service provider.
To authenticate, I'm using openid connect as SSO which is already existed in liferay 7.3.5 CE GA6.
...
- 11
0
votes
0
answers
1k
views
ADFS 2016 SSL certificate issue?
I'm running Windows Server 2016 Active Passive ADFS server, the below issue is happening on the passive node.
AD domain is single AD domain: domain.com
The same Wildcard SSL certificate has been ...
- 1,255
1
vote
1
answer
5k
views
ADFS - How to send sAMAccountName without domain
I'm using ADFS and I need to send the sAMAccountName.
Currently using a "Transform an incoming claim" rule:
Incoming claim type: Windows account name
Outgoing claim type: Name ID
Outgoing ...
- 23
1
vote
1
answer
130
views
Adding ADFS to existing AD Application
We have an existing .NET application that uses Active Directory to authenticate users and search for user/OU data using DirectorySearcher object. Our customer has several AD servers and would like our ...
- 11
0
votes
1
answer
1k
views
IDP initiated SSO does not works on Win server 2016
I am trying to setup IdP initiated SSO on Windows Server 2016. I have configured the Relying party trust and the claim rules as well. I enabled the IdP Sign on page following - https://docs.microsoft....
0
votes
1
answer
35
views
Can we add other password service like password hash as backup for ADFS?
I have configured ADFS password authentication. Now I have question if ADFS goes down for any reason, how do I cope with this situation? What steps do I need to add other password authentication ...
- 5
0
votes
0
answers
113
views
ADFS certificate-based authentication using machine (not user) certificates
I have an environment running Windows 2012 R2 ADFS. We've set up certificate-based authentication using client certificates (user certificates) and it's working as expected. They would like to use ...
- 101
0
votes
0
answers
2k
views
SAML with mod_auth_mellon results in error: Error processing authn response. Lasso error: [-432]
I have a issue with implementing SSO against ADFS with an Apache HTTPD Webserver using mod_auth_mellon. The error I get after authentication has been actually succeeded is:
Apache HTTPD returns a HTTP ...
0
votes
1
answer
763
views
Configure ADFS to allow access for server application and apply authentication policy
My goal is to delegate authentication from my OIDC Identity Provider (using Identity Server 4) to an ADFS. In ADFS I would like to configure as well that MFA has to be used in that scenario.
According ...
- 101
0
votes
1
answer
3k
views
ADFS 4.0 IDPinitiatedSignOn Page Error: HTTP 400 - Bad Request (Request header too long)
We are facing an issue with our WHFB enrollment process.
The ADFS server Windows Intergrated login process is throwing error:
HTTP 400 - Bad Request (Request header too long).
The issue is limited to ...
- 81
0
votes
1
answer
4k
views
WHfB - Hybrid Certificate Trust - Failed provisioning
After setting up Windows Hello for Business, in a Hybrid Azure AD joined Certificate Trust Deployment scenario, i ended up with the following events in my test client machine after a failed ...
0
votes
1
answer
55
views
how to handle mixed domain (onprem and oncloud users)
i need to setup adfs to activate sso for an application.
We need to use adfs because we have more tenands and subdomains. But my problem is, that we have some users existing only in cloud but not ...
- 1
0
votes
1
answer
546
views
ADFS not receiveing role information for some users
Our ADFS is no longer able to retrieve role information from Active Directory for some of our users. Two things happened around the time this issue started. The first was that the ADFS anchor claim ...
- 111
1
vote
1
answer
8k
views
AD FS Not Authenticating SAML Requests
This morning, it was brought to our attention that Active Directory Federation Services has stopped performing SAML authentications for all SAML-based relying party trusts (about 8 of them). Office ...
- 666
0
votes
1
answer
21
views
Is there a claim type in ADFS that states if the authentication was performed on the private or public interfaces?
Although I don't recall the correct terminology, my understanding is that a particular relay application may be provisioned separately for intranet only, or both intranet and internet.
I would be ...
- 101
3
votes
1
answer
1k
views
Intermittent OpenID Connect login error in ADFS 4.0
We have a Windows 2016 ADFS 4.0 farm (WID database, not SQL Server) hosted in Azure.
We are working with a new OpenID Connect application, and want to use ADFS to authenticate and populate user ...
- 41
0
votes
1
answer
292
views
Obtain NameIdentifier (sub) in AD FS
I would like to obtain the sub (NameIdentifier) of a user for an AD FS application in order to allow him to identify in an application's user table.
https://docs.microsoft.com/en-us/azure/active-...
- 105