Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [adfs]

Microsoft Active Directory Federation Service is an identity federation technology that provides single sign on access to web services and web applications using WS-* and SAML.

0
votes
0answers
25 views

CAC/Smart Card Authentication with ADFS 2012 R2 server

I've Smart Card/CAC authentication setup to work with ADFS for SSO purposes, it works when I have the UPN attribute defined in user's profile in Active Directory that matches the UPN value from the ...
0
votes
1answer
63 views

Error ID0006 while configuring AD FS Authentication in Exchange 2013

I have a fresh installation of Exchange 2013 (with SP1) hosted on a Windows Server 2012R2 box. I want to configure it for ADFS authentication. I ran the powershell commands to set the ADFS ...
0
votes
1answer
7 views

adfs giving error on authnrequest message

I have a SAML2 service provider and am trying to set up SSO with an ADFS identity provider. Currently my service provider is only working with Okta and OneLogin. When they initiate the ...
1
vote
0answers
26 views

ADFS: Show active sessions and logout users from server

To develop and test a single sign-on ADFS solution, we have set up a Windows 2012 server with ADFS. The single sign-on process now works, and it possible for our service (acting as a Service Provider) ...
0
votes
1answer
19 views

Should the AD FS Federation metadata for a Relying Party Trust be publicly accessible?

If I am a relying party, I can expose federation metadata to ease configuration for AD FS so I can import it into the Create a Relying Party Trust wizard. I can also choose to enable automatic updates ...
1
vote
1answer
61 views

Cannot set CORSEnabled and CORSTrustedOrigins properties on ADFS 2019

The Problem: There are properties in ADFS 2019 that indicate that you can enable CORS Headers for the ADFS Login Page and set the allowed origins. Get-AdfsProperties CORSEnabled ...
0
votes
0answers
18 views

Duo 2fa error System.Exception: Unable to parse username from SAML token

Running Duo Proxy 2.0 on ADFS Proxy Server to enable Duo MFA. when trying to authenticate via ADFS Proxy in to our Dynamics CRM getting an error System.Exception: Unable to parse username from SAML ...
0
votes
2answers
43 views

Disabled users are not succeeding authentication via ADFS + Multi-Factor Server

We are using the on-premise version of Azure Multifactor authentication. When I authenticate through ADFS it's forcing every user to use MFA even though I have disabled users to succeed ...
0
votes
1answer
21 views

How to test AD FS 2.0 Claim Transformation Rule?

Is there any way to do a test run on the the AD FS Claim Transformation Rule (as in this)? I have a valid SAML response, I have a more-or-less valid CTR, but how on Earth can I run the CTR against ...
0
votes
1answer
41 views

setting up ADFS without SSL certificate

I want to know if it's possible to set up ADFS on a domain controller without having to use an SSL certificate, and if you must use one, is it possible to have on created/validated for free?
1
vote
2answers
72 views

Use specific claims provider trust for a specific application group

I have a Windows Server 2016 on which I am using ADFS. I followed the link at https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-to-authenticate-users-stored-in-...
0
votes
1answer
170 views

Accessing ADFS 4.0 Endpoint through WAP gets Server 503 Error

We have an ADFS 4.0 server with a WAP server set up in the DMZ. Recently, we started getting a HTTP Error 503: Service Unavailable error when accessing endpoints through the WAP. These same endpoints ...
7
votes
2answers
373 views

Is ADFS a must-have, when you deploy hybrid exchange server?

With AADC implemented in our AD and Office 365, we want to deploy a hybrid Exchange next, is ADFS a must? Thanks!
0
votes
2answers
106 views

Do I really need a six-VM setup for reliable Azure AD FS?

I'm the sole IT admin for a small org. I'm eager to improve our security with MFA by setting up AD FS, and for lots of reasons I was hoping to do that in the cloud. There is a helpful tutorial in ...
0
votes
1answer
163 views

Is it possible to revoke or invalidate a refresh token in ADFS 4 (ADFS 2016)?

I have searched the documentation and I don't find how or if it is possible to revoke a refresh token in ADFS 4 (ADFS 2016). I'm worried about what may happen if a malicious user steals a refresh ...
0
votes
0answers
135 views

ADFS 3.0 Force SSO Token Expiration URL

I am creating an in-house web application for IT Admins that must be authenticated via Active Directory. I need to be able to support cases where the user is not logged into a workstation as ...
0
votes
0answers
33 views

What does the AD FS setting CertificateThresholdMultiplier really mean?

In trying to pinpoint problems for a certain user and AD FS setup, I'd like to speed up the certificate auto-rollover process. It appears that CertificateThresholdMultiplier would be ideal for this ...
0
votes
1answer
59 views

test ad fs using a server name instead of the certificate cn

I've just installed an AD FS 4 server farm and am trying to test connectivity to the proxy servers. In the past (AD FS 2 and 3) I used to use https://fs.domain.name/adfs/fs/federationserverservice....
0
votes
1answer
52 views

Making an HTTP Request for an ADFS IP, Getting “There are no registered protocol handlers”

I am trying to use the passive requester protocol defined in http://docs.oasis-open.org/wsfed/federation/v1.2/ws-federation.html To do this, I am making the GET Request: curl -X GET -k -i 'https://...
-1
votes
2answers
186 views

Can I federate ADFS with Azure without installing Azure AD Connect?

I'm been reading the support documents over and over but they are very ambiguous and Microsoft loves to gloss over what could help you achieve anything without installing their malware. Azure's ...
0
votes
1answer
122 views

ADFS 2016 Not Returning XML Unless Localhost

I have recently set up an ADFS 2016 server and restored an export from a previous ADFS 2.0 on Windows 2008 R2. Passed the new configuration through MS' analyzer with no issues (except for using a ...
1
vote
1answer
121 views

ADFS Event 329 - Certificate Could Not Be Decrypted

Using MS scripts, I attempted a migration of an ADFS 2.0 configuration (on Windows 2008R2) to a new ADFS server (Windows 2016) server. I have warnings in my event log that seem to be linked, via the ...
0
votes
1answer
35 views

Installing ADFS in Azure for Internal-Only access

We have an on-prem Active Directory environment that is only accessed from our corporate network. We want to extend this environment to an Azure subscription via ExpressRoute. We intended to have ...
0
votes
1answer
87 views

ADFS 2.0 -> 2016 Migration And Service Accounts

I inherited a migration of ADFS 2.0 on Windows Server 2008R2 to ADFS on Windows Server 2016. The task had been started manually, but not completed. I am using the MS scripts, and exported ...
0
votes
1answer
116 views

Unable to configure Web Application Proxy in Windows Server 2012 R2

While configuring WAP in the server I am getting the below error. Both WAP server and ADFS server are in the same Azure region and network. Powershell error
1
vote
1answer
65 views

OSname equals Microsoft Windows Server 2012 R2 Standard but AdfsVersion equals 2.0. How can this be? What to do?

Excerpted results from PowerShell query: PS C:\Windows\system32> Get-AdfsSystemInformation OSVersion : 6.2.9200.0 OSName : Microsoft Windows Server 2012 R2 ...
0
votes
1answer
147 views

Shibboleth SP 2 and ADFS sha1 to sha256

With shibboleth SP 2, I need to configure ADFS (as IdP) in advance tab SHA-1 algorithm to work fine. If I configure in ADFS SHA-256 hash algorithm, I get an error in ADFS event log, that SP reponses ...
0
votes
2answers
567 views

The SAML authentication request had a NameID Policy that could not be satisfied.

I'm using Issuance Policy as: Rule 1: Rule 2 (custom): c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/...
0
votes
0answers
263 views

MSIS7042 error when redirected to ADFS login page from relative URL

Suppose my website URL is https://sub.site.com/ When I enter this in browser, it redirects to AD FS login page. After entering credentials, it redirects user back to website. And user is able to ...
2
votes
0answers
53 views

Lsass authenticates to ADFS on windows login

I am researching a domain user lockdown problem that involves an ADFS. What happens is that anytime a domain user logins into a windows 10 machine, lsass connects to ADFS to authenticate the user ...
-1
votes
0answers
102 views

ADFS 4.0 - Wreply

Trying to get ADFS 4.0 wreply to work but it always stays on the ADFS sign-out page and not redirecting to the wreply parameter. https://testadfs/adfs/ls/?wtrealm=https%3a%2f%2flocalhost%3a50443%2f&...
0
votes
1answer
305 views

Duplicate SPN's - ADFS

Trying to setup ADFS with AD Connect. I get an error message when trying to add the ADFS service account. The error states that there is already an existing service account in the directory with the ...
1
vote
1answer
223 views

ADFS Still Active but Office 365 Domains Aren't Federated

I've inherited a network where at some point the company had both Dirsync with ADFS and Azure AD Connect running at the same time. I don't know what harm this may have caused. Dirsync was then removed....
0
votes
0answers
149 views

How to add email attribute to ADFS IdP SAML assertion for Shibboleth 2.5 as SP

I have successfully configured Apache 2 with libapache2-mod-shib2 on Debian to accept SAML assertions from ADFS (v2.0 from my understanding) In ADFS, the only way I found out to transfer user ...
0
votes
1answer
211 views

Web Application Proxy SPN Delegation

Hopefully this will be a quick one but I keep drawing a blank on how to do this even after some frantic searching online. I have recently been tasked with adding resiliency to our WAP (Web ...
0
votes
0answers
64 views

RequestedSecurityToken is not issued in usernamemixed call

Am developing server side code (CRM Plugin) which talks to SharePoint Online (REST API) from Dynamics 365 CRM Online. Am not getting the //t:RequestedSecurityToken, as our Security team is having some ...
0
votes
1answer
298 views

Office365 with AD FS Without Azure AD

This should be a simple question, but Microsoft's documentation isn't completely clear on the matter. I may have a job coming up where I'll be setting up a new Windows Server 2016 Standard deployment ...
0
votes
0answers
314 views

How do I configure Windows 2016 ADFS with AWS Cognito User Pools for a SAML identity provider?

I have an ADFS 2016 server setup to federate logins for AWS console logins. That is working perfectly. I'm now trying to integrate with AWS Cognito User Pools which has it's own SAML configuration. ...
0
votes
0answers
181 views

ADFS configuration, adding saml:AuthnContextClassRef to SAML 2.0 request

I am trying to add a custom saml:AuthnContextClassRef to my SAML Authn request to my claims provider. But I am not getting forward. I have a custom rule found on the internet that should solve the ...
0
votes
0answers
396 views

Outlook asks for credentials at first startup after sign in to Windows with ADAL enabled

We have a strange problem with our RDS Server 2016 environment. All servers are Server 2016. Office is latest Office 2016 / 365 with shared key activation enabled. User logs in to our RDS darm with ...
3
votes
1answer
253 views

How to integrate Office 365 with Microsoft on-premise Multi-Factor Authentication?

We purchased Microsoft Multi-Factor Authentication (on-premise). How do I integrate that with Office 365? We have Azure AD Connect syncing on premise AD to Azure. We also have ADFS setup to ...
0
votes
1answer
227 views

AD FS - Having Federated Web SSO, the Account partner fails to login to SharePoint, whereas Resource partner is OK

When implementing Federated Web SSO design between to access SharePoint in resource partner organization and when seemingly doing everything correctly as within step-by-step tutorial Windows Server ...
0
votes
0answers
496 views

SAML error for SSO with ADFS - MSIS0038: SAML Message has wrong signature

Hi I am trying to use SSO to authenticate my client's users directly to my website. My client's IDP is Microsoft ADFS and I am using Passport-SAML (https://github.com/bergie/passport-saml) to ...
0
votes
1answer
433 views

AD FS and Claims Provider Trust for an external IdP

I need to add an external IdP to our organization's AD FS as a Claims Provider Trust. The external IdP has an XML metadata published, but it contains tens and tens of different external sub-...
0
votes
1answer
85 views

Combination SAML and SSL Offloader causes error

Last night we tried to migrate a website to our new hosting provider. This new hosting provider uses a SSL offloader and this causes a problem with a website using SAML. After the migration when we ...
1
vote
1answer
247 views

Issue installing Azure AD Connect ADFS Health Agent

I'm trying to install the Azure AD Connect ADFS health agent on the primary server in an ADFS 4.0 farm running on Windows Server 2016. The installation completes successfully but I get an error on ...
2
votes
1answer
660 views

ADFS: Convert SAML Assertion to OAuth Token?

We have Microsoft Active Directory Federation Services (ADFS) as our authentication/federation provider. We use it for performing identity federation via SAML to several external vendors, SaaS ...
0
votes
1answer
645 views

ADFS 2012 R2 - Office 365 Modern Auth - Outlook able to connect outside network

Wondering if you guys could help as I'm stuck! I have configured ADFS for authentication for our Office 365 tenant in order to provide us with the ability to prevent access to all of Office 365 based ...
1
vote
0answers
721 views

How should the relying trust be set up in ADFS for SAML-based SSO?

We've done SAML-based SP-initiated SSO with a number of customers, and it's all been ok (eventually). We've got a customer now who's using ADFS. We can get idP-initiated to work fine, but with SP-...
0
votes
0answers
681 views

Getting 404 for URL /adfs/ls in SP initiated sign on

I have done configurations to set up SSO using ADFS (on windows server 2012 R2) and shibboleth (on Ubuntu 12.x box). Whenever I do SP initiated sign on i.e. https://mywebapp.com/authsml; the URL gets ...