Questions tagged [saml]

SAML (Security Assertion Markup Language) is an open standard and XML-based markup language for exchanging authentication and authorization information between parties, known as service providers and identity providers.

Filter by
Sorted by
Tagged with
0
votes
1answer
72 views

Setting up Single-Sign-On with AWS and Keycloak

I want to setup a SSO solution using Keycloak 10.0.2 as the Identity Provider. The first application I want to setup is AWS. I followed this tutorial to enable Keycloak to sign me in using SAML. I ...
0
votes
0answers
37 views

Azure AD SSO SAML online Assertion ID (token) validation

We have Microsoft Azure Active Directory as our IdP provider. We use a Spring Security SAML service as SP to perform SSO / SAML login into our internal services. All is working fine and the ...
0
votes
1answer
42 views

AzureAD IDP Initiated SAML always return nameid-format:persistent instead of nameid-format:emailAddress

I'm developing SSO using SAML and my IdP is Azure. I'm having problem with IDP Initiated flow. In SAML Response I always get this NameID: <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:...
0
votes
1answer
205 views

Configure AWS SSO with Auth0 as IDP

I am trying to configure “AWS SSO”'s to work with Auth0 as an External Identity Provider. I have made is to the point where I am getting the auth0 login as success but AWS throws me an error. error I ...
0
votes
0answers
51 views

How to create two apps in MS Azure with the same Entity IDs?

I am needing some technical inputs to overcome a technical challenge with regards to an MS Azure app. Goes like this... We have manually configured a non-gallery app in MS Azure which allows a ...
1
vote
1answer
838 views

AD FS Not Authenticating SAML Requests

This morning, it was brought to our attention that Active Directory Federation Services has stopped performing SAML authentications for all SAML-based relying party trusts (about 8 of them). Office ...
0
votes
0answers
15 views

Account mapping with salesforce SAML login

I'm developing an application (Service provider) that uses Salesforce as IDp, login flow is based on SAML 2.0. We have user databases on both sides. How would you implement the following logic: When ...
0
votes
1answer
29 views

Redirect Google Authentication to Microsoft Authentication to use with SAML

At this point I have an issue where I want to login to Google Identity's assets but using Azure AD as the IdP (Identity Provider). I already have the whole SAML environment setup with google as the ...
0
votes
1answer
14 views

Is there a claim type in ADFS that states if the authentication was performed on the private or public interfaces?

Although I don't recall the correct terminology, my understanding is that a particular relay application may be provisioned separately for intranet only, or both intranet and internet. I would be ...
0
votes
0answers
16 views

any command line support for g suite saml apps?

I have a bunch of my services using gsuite saml auth Its super easy to setup and use when logging into these services via a web browser But for some services I want to access them via command line, ...
4
votes
1answer
199 views

Sure of Valid Parameter set, Powershell Says: “Parameter set cannot be resolved…”

I'm attempting to run a Powershell cmdlet that only accepts one of three specific parameters. I'm positive that I know what those parameters are, and that I am entering those parameters correctly. I ...
0
votes
1answer
70 views

Is there an SSO mechanism supported as widely as LDAP?

LDAP is pretty amazing. It lets you set up a bunch of web services that all share a common user database (or rather, directory), so you can have a WordPress installation, a NextCloud, a MediaWiki etc, ...
0
votes
0answers
29 views

Proxy Auth using Google SSO with SAML

I'm in charge of making a poc for a proxy machine who will authenticate user via Google SSO (SAMLv2). Once the user is authenticated, the proxy will let him through to access the url he was ...
0
votes
0answers
36 views

Testing web app with SAML authentication locally

I've been transitioning my web app authentication from Active Directory to SAML with OneLogin using python-saml. Before making the change to SAML, I was able to run the website on localhost. After ...
0
votes
0answers
38 views

Is it possible to allow a user to sign in to a Federated Office 365 domain with Email and Password?

The background: I have recently federated my Office 365 instance with a SAML provider. After configuring it, when I attempted to sign in to Office 365, I was directed to the IDP to auth and when I ...
0
votes
0answers
26 views

Azure user federation with third party Identity Provider (IdP)

Amazon AWS supports user federation with third party Identity Provider (IdP), which means I can sign in to AWS console with my own user pool. I set up keycloak as IdP and succeeded in federating AWS ...
0
votes
0answers
44 views

ELB not passing code and state from cognito to EC2 after authentication

I am trying to perform ADFS authentication through AWS Cognito behind my AWS ELB, but unable to get success. Following is the flow of request GET example.org/appname 302 GET CognitoLogin 200 GET ...
1
vote
0answers
302 views

How to download SAML XML metadata from Microsoft Azure

I have an enterprise application that implements SAML SSO, and I have a new client who wishes to use it. This feature works with other clients. However, the application requires that the client ...
0
votes
2answers
324 views

Google App Engine and SAML (Okta)

We're trying to setup a web app (django) in Google App Engine connected via SAML to our idP, Okta. It has to be done as a Custom Flexible App because of a binary requirement, making it basically a ...
2
votes
0answers
70 views

AADSTS700517 using AWS Cognito and Azure AD Enterprise App

I have configured an AWS Cognito UserPool to use an Azure AD Enterprise Application as a SAML federated identity provider as per the blog post here: https://medium.com/the-apps-team/how-to-add-azure-...
1
vote
1answer
174 views

Set an attribute as MellonUser on mod_mellon

I'm failing to setup MelonUser on my Apache configuration. The NAME_ID my IdP provides in really a session ID that changes every time, and it's the only data available in the Subject of the response. ...
2
votes
1answer
98 views

ADFS Alternative questions

We had (Before it went belly up) an ADFS server that was simply doing a translation from SAML 2.0 to WSFED (My end point software can not take in SAML only WSFED). My question is, what are the ...
0
votes
0answers
63 views

Is G Suite as a SAML IdP a replacement for Okta?

G Suite supports acting as the identity provider to SAML-compatible service providers, in the same way as Okta does. However, you pay a premium for Okta whereas Google SAML is included in the G Suite ...
0
votes
1answer
526 views

adfs giving error on authnrequest message

I have a SAML2 service provider and am trying to set up SSO with an ADFS identity provider. Currently my service provider is only working with Okta and OneLogin. When they initiate the ...
1
vote
1answer
151 views

Should the AD FS Federation metadata for a Relying Party Trust be publicly accessible?

If I am a relying party, I can expose federation metadata to ease configuration for AD FS so I can import it into the Create a Relying Party Trust wizard. I can also choose to enable automatic updates ...
0
votes
2answers
4k views

The SAML authentication request had a NameID Policy that could not be satisfied.

I'm using Issuance Policy as: Rule 1: Rule 2 (custom): c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/...
0
votes
0answers
1k views

SAML error for SSO with ADFS - MSIS0038: SAML Message has wrong signature

Hi I am trying to use SSO to authenticate my client's users directly to my website. My client's IDP is Microsoft ADFS and I am using Passport-SAML (https://github.com/bergie/passport-saml) to ...
0
votes
1answer
322 views

Combination SAML and SSL Offloader causes error

Last night we tried to migrate a website to our new hosting provider. This new hosting provider uses a SSL offloader and this causes a problem with a website using SAML. After the migration when we ...
2
votes
1answer
1k views

ADFS: Convert SAML Assertion to OAuth Token?

We have Microsoft Active Directory Federation Services (ADFS) as our authentication/federation provider. We use it for performing identity federation via SAML to several external vendors, SaaS ...
0
votes
1answer
539 views

Getting error “Oops, this link isn’t working…” in the browser when testing a SAML SSO configured in Azure AD as non-gallery application

I have configured a non-gallery application in order to set up SAML for one of our clients. To the best of our knowledge, all the settings are properly set - I'm just this is just a basic mistake or ...
1
vote
2answers
805 views

Signature verification for InCommon SAML metadata using xmlsec1 fails

InCommon Federation provides IdP and SP metadata. Their refresh policy recommends frequent checking of the metadata aggregate to use the most recent version. They strongly recommend InCommon SPs ...
2
votes
0answers
2k views

How should the relying trust be set up in ADFS for SAML-based SSO?

We've done SAML-based SP-initiated SSO with a number of customers, and it's all been ok (eventually). We've got a customer now who's using ADFS. We can get idP-initiated to work fine, but with SP-...
0
votes
1answer
579 views

Getting junk while accessing federationMetadata.xml on Windows server 2012 R2

I have setup ADFS on windows server 2012R2 using self signed certificate. ADFS has been installed successfully. But when I try to access the federationMetadata.xml using https:///FederationMetadata/...
1
vote
1answer
66 views

customise saml attributes Azure AD

I have configured SAML SSO against a new app in my Azure Console. I have proven it authenticates using simplesamlPHP. I am trying to add/adjust the attributes that are passed back with the SAML token. ...
0
votes
1answer
1k views

How can I remove or delete an outgoing claim in AD FS?

My client's claims issuance rules for a relying trust don't include this claim, but it ends up in the outgoing claims and crashes Okta: http://schemas.microsoft.com/2012/01/devicecontext/claims/...
2
votes
1answer
500 views

single sign-on to multiple SAML SPs with one IdP

Part of our site, say https://www.example.com/files, is protected by mod_auth_mellon, which provides an SP that authenticates with our IdP. This works fine. The rest of the site is Drupal with the ...
0
votes
1answer
539 views

Shibboleth IdP won't start with Jetty 9.3

I've been following this guide to install Shibboleth Identity Provider 3.3.2 on Jetty 9.3.22 (Ubuntu Server 16.04 with Oracle JDK 8u151). At https://my.server.ip/idp I get a 503 error (Service ...
2
votes
1answer
1k views

Combine apache auth providers of different types with basic auth only if proactively provided by client

I'd like to be able to have a path on an apache server (2.4.18+ on ub16) that primarily authenticates using SAML (using the mod_auth_mellon plugin) for interactive use, but also supports having the ...
1
vote
1answer
11k views

Specify MFA based on user-agent in AD FS?

Is it possible to force a specific MFA provider based on a user-agent (ideal) or IP address (less ideal) in AD FS? Alternatively, is there another free SAML IdP that would allow this? Read below for ...
11
votes
1answer
908 views

Microsoft Exchange Federation Trust Broken After Verifying in Office 365

Okay so...this all started during our Office 365 setup. According to Microsoft, you have to delete your on-premises federation trust from Exchange, verify the domain, then add it back...otherwise you ...
0
votes
1answer
180 views

How to configure AssertionConsumerServiceIndex processing in Okta?

In my Okta App I set up Single sign on URL and a couple of Requestable SSO URLs. The idea is that I send a SAML message with index, and Okta chooses one of requestable SSO urls to send a response. ...
0
votes
1answer
1k views

.NET Issue on ADFS SSO behind a Reverse Proxy

I have a .NET application that uses ADFS for SSO. It works when I test it on my local machine and test environment but it fails when deployed to the client environment. The client environment is like ...
0
votes
1answer
726 views

Azure AD SAML2 SSO issues wrong AuthnInstant in SAMLResponse

I'm integrating my application with MS Azure AD IDP for SAML2 IDP-initiated single sign on. I am using my company's Office 365 account and Azure AD service accessible through it. In my test ...
0
votes
0answers
134 views

Identity providers for SSO and untrusted sites

I am implementing SSO between a custom PHP app and an in house tableau server using SAML. I chose auth0 as my identity provider. I got it working with a test version of the app running in a Vagrant VM....
0
votes
2answers
3k views

ADFS site selection redirect landing page

I want to know how to change the default landing page of an ADFS connected site after browsing to it from site selection. In the pic attached you can see I have a site called "My PHP Application" and ...
0
votes
1answer
3k views

SHIBBOLETH SP - Shibboleth handler invoked at an unconfigured location - Shibboleth.sso/Session/

I am trying to get shibboleth configured. When I go to https://mysite/secure/index.php, it works properly, I can authenticate, etc. but when I go to https://mysite/Shibboleth.sso/Status (or any other ...
0
votes
1answer
2k views

Try to reverse-proxy vsphere webclient with Apache

We want to protect our VMWare vsphere 6.5 web client with an already existing & working Apache 2.4 reverse proxy (benefits e.g. centralised monitoring, mod_security et.al.) Both communications ...
1
vote
1answer
305 views

Does Shibboleth IdP 3 automatically echo relay state by default?

Maybe this is a dumb question, but I can't find any anything about this in the documentation or elsewhere. According to the SAML spec, I know that the IdP is supposed to echo back the relay state ...
0
votes
1answer
290 views

Beginner ADFS SAML setup with Pingone

Have an external web application our company is going to use at a hosting company. They sent us the setup for PingOne invited SSO. Everything seems pretty straightforward. I began setting up our ADFS ...
1
vote
0answers
34 views

SAML Azure mappings

I'm trying to setup SocialCast to use SSO against Azure AD. I have everything working except I'm unable to map the fields for first name, last name, and email address. I know authentication is ...