Questions tagged [saml]
SAML (Security Assertion Markup Language) is an open standard and XML-based markup language for exchanging authentication and authorization information between parties, known as service providers and identity providers.
100
questions
1
vote
1
answer
370
views
Azure SAML claim configuration shows emailaddress in the default template, but also shows "This claim is restricted"
We are created a claim in the Azure interface for SAML and by default the email address is included in the template when we first create it. Everything was working fine, however a rookie was messing ...
- 11
0
votes
1
answer
86
views
Unable to setup SAML with internal IdP (SP is checking for valid URL)
I've been reading through the various ways to configure an IdP/SP relationship and going back forth with a vendor I'm setting up our IdP to authenticate with. We've exchanged metadata and the ...
- 761
0
votes
0
answers
30
views
Can ADFS present one IDP to SAML SP, but authenticate against multiple AD servers on the back end?
Summary
Can ADFS present one IDP to a SAML Service Provider (SP), but authenticate against multiple AD servers on the back end?
Context
Here's the usecase:
Company Foo has bought company Bar
They ...
- 315
0
votes
1
answer
884
views
ADFS Client Certificate Authentication
I have ADFS on my environment and it's currently authenticating via active directory perfectly fine. I'm trying to enable certificate authentication so they can authenticate with their smart cards. ...
- 1
0
votes
0
answers
121
views
AD FS SP forcing custom AuthnRequest
AD FS Error:
Exception details: Microsoft.IdentityServer.Service.Policy.PolicyServer.Engine.UnknownAuthenticationTypePolicyException: MSIS3305: None of the AuthenticationContext class references ...
- 1
1
vote
0
answers
137
views
Implement SSO between a custom app and Microsoft 365 with custom identity provider
I’m trying to implement SSO between a custom app and Microsoft 365 so that when the users hit any link to Teams o SharePoint Online in the Liferay app, ADFS doesn't ask for credentials. Context:
ADFS ...
0
votes
0
answers
76
views
ADFS Claims Provider not receiving username/email
I have an on-prem ADFS setup as below with SAML2,
SP <=> ADFS <=> IDP
When the SP initiates an authentication, the client can redirect to the IDP (configured as a Claims Provider) and ...
- 111
0
votes
0
answers
179
views
Auth Mellon on Apache is giving 404 for login endpoint
I'm trying to set up SAML auth on a subfolder of an apache 2.4 vhost using auth_mellon, following the instructions here: https://richard-purves.com/2019/05/07/apache-saml-sso-the-hard-way/
In the ...
- 1
1
vote
1
answer
34
views
How can I authenticate workstation on Azure ID when tenant uses SAML to Google?
I have some clients using Google SALM (https://support.google.com/a/answer/6363817?hl=en) on Microsoft O365, when a user need access to Office 365 tools and use your corporate e-mail account, ...
- 21
0
votes
1
answer
846
views
Issues configuring SAML authentication in Apache Guacamole behind a HAProxy
I've deployed an Apache Guacamole server and trying to configure SSO using SAML with a Cloud IdaaS. HAproxy is in front of the Guacamole server, providing SSL offloading. Apache Guacamole was ...
- 219
0
votes
2
answers
211
views
Only federate some users in AzureAD and not a whole domain
We want to test a new IDP in our organization ( this IDP is an inhouse SAML-compatible idp ). We are using AzureAD.
If we federate a new domain, we can test the authentication, and it works ( xxx@...
- 99
0
votes
0
answers
339
views
Login to SSL VPN via SSO and then use SSO inside VPN for other Service Providers possible?
I have a setup where you authorize via SAML SSO (keycloak as idp) to access a SSL VPN (fortigate as sp). Now inside the VPN there are authorization reverse proxy servers.
Is it possible to have the ...
- 1
0
votes
2
answers
252
views
ADFS as proxy to some IDP
As far as I know, Exchange does support WS-Federation, but it does not support SAML. At the same time I have IDP that does support SAML, but does not support WS-Federation.
Is it possible to configure ...
- 145
0
votes
1
answer
3k
views
SAML 2.0 NameIDPolicy that was not satisfied by the issued token
I am working on a SAML integration with some monitoring software, but I keep receiving the MSIS7070 error below. I have tried numerous transform combinations with no luck. I am certain this is ...
- 111
1
vote
0
answers
256
views
Wildfly Elytron container managed authentication with federated SAML2 IDP
I'm trying to set up container-managed authentication with Wildfly 24 and would like to use an existing (federated) Shibboleth IDP.
I haven't found docs detailing that use case, so I opted for the ...
- 9,609
0
votes
1
answer
103
views
Migrating from Azure AD SSO authentication to ADFS
We are having a customer with the following setup.
onPrem Active Directory with Azure AD Connect and Password Hash Sync (PHS) including SSO activation
SSO for all M365 apps
Integration of about 15 ...
- 1
-1
votes
1
answer
91
views
IBM iWelcome as federated IdP for Azure AD: any experience?
Is there any experience in configuring IBM iWelcome as federated IdP for Azure AD?
The scenario is:
A user register on iWelcome by specifying her/his original email as user identifier (NOTE: this ...
Stefano
0
votes
2
answers
205
views
How do I convert a multi-value SAML attribute to a single-value string in ADFS?
I previously asked a similar question about doing this in Azure AD. However, I've come to the conclusion that it is probably too limited to do this and I received no answers.
However, in ADFS there is ...
- 3,488
0
votes
1
answer
609
views
Auth Mellon is not redirecting to IDP. Apache is returning 404 for /mellon
I am trying to enable auth mellon for on-prem weblogic app.
I have apache httpd and auth mellon installed on RHEL 6.8. I followed instructions as per https://github.com/Uninett/mod_auth_mellon/wiki/...
- 51
4
votes
2
answers
11k
views
AADSTS50107: Requested federation realm object does not exist, when integrating Okta as an IdP for AAD
I'm trying to set up AAD with Okta, and find that when users visit the App Embed link and it posts their SAML response to https://login.microsoftonline.com/login.srf, they get an unhelpful error:
...
- 25.3k
2
votes
0
answers
783
views
Subversion Server with Azure AD SSO
There is a running CollabNet Subversion Edge Server in the current version 5.2.4.
It is currently connected with LDAP for authentication.
Now there is a challenge to grant permission to b2b guests of ...
- 45
1
vote
0
answers
38
views
Why don't identity providers have separate IDs and Names in Openstack?
I think most of the things have a separate ID and a separate Name in Openstack (Users, Projects, virtual machines, etc). Why don't identity providers have separate IDs and Names? Are there other ...
- 11
1
vote
0
answers
570
views
Why isn't Kerberos used for SSO to cloud apps?
When comparing Kerberos to SAML, a common argument on StackOverflow sites and the rest of Internet is that SAML is for Internet / cloud applications while Kerberos is for enterprise LAN. There are ...
- 187
1
vote
0
answers
64
views
Integrating GitHub Org with SAML shibboleth & post actions
I am at the beginner level of GitHub cloud administration and looking for answers to the below-listed questions after I enable SAML integration (Shibboleth) for my Github cloud Organisation.
Before ...
github
-1
votes
1
answer
46
views
how we can generate the single sign on and reply url for new application in azure active directory
I am going to register a new application in the Azure active directory for SAML login.
How can I generate my reply URL and single sign on url and entity ID ?
2
votes
1
answer
683
views
Where does Chrome fetch my identity from after having deleted cookies?
I'm trying to figure out where does Google CHrome fetch my identity from when authenticating to an Identity Provider (SAML with certificate authentication)
What I have tried :
Delete all cookies, ...
- 292
1
vote
0
answers
36
views
Windows ADFS User Certificate URL
I have setup a window lab server based on windows server 2012 r2. I have an AD, ADFS and CS.
I have setup User certificate enrollment. Everything work fine but I have a litle issue.
I have setup ADFS ...
0
votes
0
answers
2k
views
How to configure Azure SAML authentication for Rapid7 InsightVM / nexpose
I'm trying to use Azure AD SAML for authenticating to Rapid7 InsightVM (Nexpose)
I have the Enterprise Application registered in AAD, with the EntityID provided from the InsightVM configuration. The ...
- 740
0
votes
1
answer
62
views
SAML sync users
Currently we are using SAML SSO,
the client starts the Azure Enterprise App,
provides us with tenantId, appId, certificate, and its users can log in to us through their Microsoft account.
Can we use ...
- 101
1
vote
1
answer
5k
views
ADFS - How to send sAMAccountName without domain
I'm using ADFS and I need to send the sAMAccountName.
Currently using a "Transform an incoming claim" rule:
Incoming claim type: Windows account name
Outgoing claim type: Name ID
Outgoing ...
- 23
0
votes
1
answer
1k
views
IDP initiated SSO does not works on Win server 2016
I am trying to setup IdP initiated SSO on Windows Server 2016. I have configured the Relying party trust and the claim rules as well. I enabled the IdP Sign on page following - https://docs.microsoft....
0
votes
0
answers
2k
views
SAML with mod_auth_mellon results in error: Error processing authn response. Lasso error: [-432]
I have a issue with implementing SSO against ADFS with an Apache HTTPD Webserver using mod_auth_mellon. The error I get after authentication has been actually succeeded is:
Apache HTTPD returns a HTTP ...
2
votes
2
answers
2k
views
How can I resolve "SAML Providers must reference at least one SAML assertion issuer" message?
I want to setup a SSO solution using Keycloak 10.0.2 as the Identity Provider. The first application I want to setup is AWS.
I followed this tutorial to enable Keycloak to sign me in using SAML. I ...
- 162
1
vote
2
answers
657
views
AzureAD IDP Initiated SAML always return nameid-format:persistent instead of nameid-format:emailAddress
I'm developing SSO using SAML and my IdP is Azure.
I'm having problem with IDP Initiated flow. In SAML Response I always get this NameID:
<NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:...
- 111
0
votes
1
answer
1k
views
Configure AWS SSO with Auth0 as IDP
I am trying to configure “AWS SSO”'s to work with Auth0 as an External Identity Provider. I have made is to the point where I am getting the auth0 login as success but AWS throws me an error.
error I ...
- 153
1
vote
1
answer
8k
views
AD FS Not Authenticating SAML Requests
This morning, it was brought to our attention that Active Directory Federation Services has stopped performing SAML authentications for all SAML-based relying party trusts (about 8 of them). Office ...
- 666
0
votes
1
answer
488
views
Redirect Google Authentication to Microsoft Authentication to use with SAML
At this point I have an issue where I want to login to Google Identity's assets but using Azure AD as the IdP (Identity Provider).
I already have the whole SAML environment setup with google as the ...
google-cloud-platform
0
votes
1
answer
23
views
Is there a claim type in ADFS that states if the authentication was performed on the private or public interfaces?
Although I don't recall the correct terminology, my understanding is that a particular relay application may be provisioned separately for intranet only, or both intranet and internet.
I would be ...
- 101
4
votes
1
answer
950
views
Sure of Valid Parameter set, Powershell Says: "Parameter set cannot be resolved..."
I'm attempting to run a Powershell cmdlet that only accepts one of three specific parameters. I'm positive that I know what those parameters are, and that I am entering those parameters correctly. I ...
- 43
0
votes
1
answer
110
views
Is there an SSO mechanism supported as widely as LDAP?
LDAP is pretty amazing. It lets you set up a bunch of web services that all share a common user database (or rather, directory), so you can have a WordPress installation, a NextCloud, a MediaWiki etc, ...
- 141
2
votes
0
answers
3k
views
How to download SAML XML metadata from Microsoft Azure
I have an enterprise application that implements SAML SSO, and I have a new client who wishes to use it. This feature works with other clients. However, the application requires that the client ...
- 21
0
votes
2
answers
615
views
Google App Engine and SAML (Okta)
We're trying to setup a web app (django) in Google App Engine connected via SAML to our idP, Okta. It has to be done as a Custom Flexible App because of a binary requirement, making it basically a ...
2
votes
0
answers
261
views
AADSTS700517 using AWS Cognito and Azure AD Enterprise App
I have configured an AWS Cognito UserPool to use an Azure AD Enterprise Application as a SAML federated identity provider as per the blog post here: https://medium.com/the-apps-team/how-to-add-azure-...
1
vote
1
answer
887
views
Set an attribute as MellonUser on mod_mellon
I'm failing to setup MelonUser on my Apache configuration. The NAME_ID my IdP provides in really a session ID that changes every time, and it's the only data available in the Subject of the response.
...
- 205
2
votes
1
answer
124
views
ADFS Alternative questions
We had (Before it went belly up) an ADFS server that was simply doing a translation from SAML 2.0 to WSFED (My end point software can not take in SAML only WSFED).
My question is, what are the ...
- 73
0
votes
0
answers
220
views
Is G Suite as a SAML IdP a replacement for Okta?
G Suite supports acting as the identity provider to SAML-compatible service providers, in the same way as Okta does.
However, you pay a premium for Okta whereas Google SAML is included in the G Suite ...
- 101
0
votes
1
answer
1k
views
adfs giving error on authnrequest message
I have a SAML2 service provider and am trying to set up SSO with an ADFS identity provider. Currently my service provider is only working with Okta and OneLogin. When they initiate the ...
- 129
1
vote
1
answer
555
views
Should the AD FS Federation metadata for a Relying Party Trust be publicly accessible?
If I am a relying party, I can expose federation metadata to ease configuration for AD FS so I can import it into the Create a Relying Party Trust wizard. I can also choose to enable automatic updates ...
- 111
0
votes
2
answers
8k
views
The SAML authentication request had a NameID Policy that could not be satisfied.
I'm using Issuance Policy as:
Rule 1:
Rule 2 (custom):
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"]
=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/...
- 185
0
votes
1
answer
468
views
Combination SAML and SSL Offloader causes error
Last night we tried to migrate a website to our new hosting provider. This new hosting provider uses a SSL offloader and this causes a problem with a website using SAML. After the migration when we ...
- 1