Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [saml]

SAML (Security Assertion Markup Language) is an open standard and XML-based markup language for exchanging authentication and authorization information between parties, known as service providers and identity providers.

0
votes
0answers
5 views

OneLogin Trusted IdP JIT provisioning

I'm trying to link two OneLogin accounts using the Trusted IdP functionality. I've the setup going if I create the user on the target OneLogin account by hand. Now I want to use JIT like in this ...
2
votes
0answers
8 views

AADSTS700517 using AWS Cognito and Azure AD Enterprise App

I have configured an AWS Cognito UserPool to use an Azure AD Enterprise Application as a SAML federated identity provider as per the blog post here: https://medium.com/the-apps-team/how-to-add-azure-...
1
vote
1answer
26 views

Set an attribute as MellonUser on mod_mellon

I'm failing to setup MelonUser on my Apache configuration. The NAME_ID my IdP provides in really a session ID that changes every time, and it's the only data available in the Subject of the response. ...
2
votes
1answer
42 views

ADFS Alternative questions

We had (Before it went belly up) an ADFS server that was simply doing a translation from SAML 2.0 to WSFED (My end point software can not take in SAML only WSFED). My question is, what are the ...
0
votes
0answers
36 views

ADFS Claim Rules Not Returning Any Details

I have ADFS 3.0 set up and any user in the domain can login to my site (authentication was done previously with LDAP). I set up some claim rules so that I can get the user's name, email address, and ...
0
votes
0answers
11 views

SAML authentication to Azure

I am trying to configure Azure for SAML authentication using Ping Federate as IdP. I have configured the connection and the AD Connect wizard reports that it had retrieved the metadata from Ping ...
0
votes
0answers
20 views

How can I find the SAML 2.0 Identity Provider URL in ADFS?

My company provides a system that supports SAML 2.0. A customer has bought that system and wishes to set up single sign on using SAML. This is trivially easy using things like GSuite, but our customer ...
0
votes
0answers
9 views

saml authenticated portal for webserver

A couple of years ago I setup my own homeserver with a collection of services including FlexRaid, CouchPotato, SabNZB, Plex etc. These services are all exposed and can be accessed from the web. In ...
0
votes
0answers
21 views

Is G Suite as a SAML IdP a replacement for Okta?

G Suite supports acting as the identity provider to SAML-compatible service providers, in the same way as Okta does. However, you pay a premium for Okta whereas Google SAML is included in the G Suite ...
0
votes
1answer
70 views

adfs giving error on authnrequest message

I have a SAML2 service provider and am trying to set up SSO with an ADFS identity provider. Currently my service provider is only working with Okta and OneLogin. When they initiate the ...
1
vote
1answer
32 views

Should the AD FS Federation metadata for a Relying Party Trust be publicly accessible?

If I am a relying party, I can expose federation metadata to ease configuration for AD FS so I can import it into the Create a Relying Party Trust wizard. I can also choose to enable automatic updates ...
0
votes
2answers
978 views

The SAML authentication request had a NameID Policy that could not be satisfied.

I'm using Issuance Policy as: Rule 1: Rule 2 (custom): c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/...
0
votes
0answers
215 views

How to add email attribute to ADFS IdP SAML assertion for Shibboleth 2.5 as SP

I have successfully configured Apache 2 with libapache2-mod-shib2 on Debian to accept SAML assertions from ADFS (v2.0 from my understanding) In ADFS, the only way I found out to transfer user ...
0
votes
0answers
16 views

SAML SP Certificate Changing: do changes actually need to happen at the Identity Provider for a CA-issued cert?

Our certificate that we use for signing SAML redirect requests is expiring. We've renewed the certificate by a trusted CA, but I've been told that once we update the certificate, we need to notify ...
0
votes
0answers
673 views

SAML error for SSO with ADFS - MSIS0038: SAML Message has wrong signature

Hi I am trying to use SSO to authenticate my client's users directly to my website. My client's IDP is Microsoft ADFS and I am using Passport-SAML (https://github.com/bergie/passport-saml) to ...
0
votes
1answer
124 views

Combination SAML and SSL Offloader causes error

Last night we tried to migrate a website to our new hosting provider. This new hosting provider uses a SSL offloader and this causes a problem with a website using SAML. After the migration when we ...
2
votes
1answer
796 views

ADFS: Convert SAML Assertion to OAuth Token?

We have Microsoft Active Directory Federation Services (ADFS) as our authentication/federation provider. We use it for performing identity federation via SAML to several external vendors, SaaS ...
0
votes
1answer
263 views

Getting error “Oops, this link isn’t working…” in the browser when testing a SAML SSO configured in Azure AD as non-gallery application

I have configured a non-gallery application in order to set up SAML for one of our clients. To the best of our knowledge, all the settings are properly set - I'm just this is just a basic mistake or ...
1
vote
1answer
390 views

Signature verification for InCommon SAML metadata using xmlsec1 fails

InCommon Federation provides IdP and SP metadata. Their refresh policy recommends frequent checking of the metadata aggregate to use the most recent version. They strongly recommend InCommon SPs ...
2
votes
0answers
1k views

How should the relying trust be set up in ADFS for SAML-based SSO?

We've done SAML-based SP-initiated SSO with a number of customers, and it's all been ok (eventually). We've got a customer now who's using ADFS. We can get idP-initiated to work fine, but with SP-...
0
votes
1answer
399 views

Getting junk while accessing federationMetadata.xml on Windows server 2012 R2

I have setup ADFS on windows server 2012R2 using self signed certificate. ADFS has been installed successfully. But when I try to access the federationMetadata.xml using https:///FederationMetadata/...
1
vote
1answer
34 views

customise saml attributes Azure AD

I have configured SAML SSO against a new app in my Azure Console. I have proven it authenticates using simplesamlPHP. I am trying to add/adjust the attributes that are passed back with the SAML token. ...
0
votes
1answer
842 views

How can I remove or delete an outgoing claim in AD FS?

My client's claims issuance rules for a relying trust don't include this claim, but it ends up in the outgoing claims and crashes Okta: http://schemas.microsoft.com/2012/01/devicecontext/claims/...
0
votes
0answers
755 views

Shibboleth reverse proxy configuration

We have a service at some domain example.com. This application is protected by shibboleth, and is behind a reverse proxy. Have tried what was in documentation: https://wiki.shibboleth.net/confluence/...
3
votes
1answer
301 views

single sign-on to multiple SAML SPs with one IdP

Part of our site, say https://www.example.com/files, is protected by mod_auth_mellon, which provides an SP that authenticates with our IdP. This works fine. The rest of the site is Drupal with the ...
0
votes
1answer
370 views

Shibboleth IdP won't start with Jetty 9.3

I've been following this guide to install Shibboleth Identity Provider 3.3.2 on Jetty 9.3.22 (Ubuntu Server 16.04 with Oracle JDK 8u151). At https://my.server.ip/idp I get a 503 error (Service ...
1
vote
1answer
682 views

Combine apache auth providers of different types with basic auth only if proactively provided by client

I'd like to be able to have a path on an apache server (2.4.18+ on ub16) that primarily authenticates using SAML (using the mod_auth_mellon plugin) for interactive use, but also supports having the ...
1
vote
1answer
11k views

Specify MFA based on user-agent in AD FS?

Is it possible to force a specific MFA provider based on a user-agent (ideal) or IP address (less ideal) in AD FS? Alternatively, is there another free SAML IdP that would allow this? Read below for ...
12
votes
1answer
552 views

Microsoft Exchange Federation Trust Broken After Verifying in Office 365

Okay so...this all started during our Office 365 setup. According to Microsoft, you have to delete your on-premises federation trust from Exchange, verify the domain, then add it back...otherwise you ...
0
votes
1answer
132 views

How to configure AssertionConsumerServiceIndex processing in Okta?

In my Okta App I set up Single sign on URL and a couple of Requestable SSO URLs. The idea is that I send a SAML message with index, and Okta chooses one of requestable SSO urls to send a response. ...
0
votes
1answer
1k views

.NET Issue on ADFS SSO behind a Reverse Proxy

I have a .NET application that uses ADFS for SSO. It works when I test it on my local machine and test environment but it fails when deployed to the client environment. The client environment is like ...
0
votes
1answer
404 views

Azure AD SAML2 SSO issues wrong AuthnInstant in SAMLResponse

I'm integrating my application with MS Azure AD IDP for SAML2 IDP-initiated single sign on. I am using my company's Office 365 account and Azure AD service accessible through it. In my test ...
0
votes
0answers
112 views

Identity providers for SSO and untrusted sites

I am implementing SSO between a custom PHP app and an in house tableau server using SAML. I chose auth0 as my identity provider. I got it working with a test version of the app running in a Vagrant VM....
0
votes
2answers
2k views

ADFS site selection redirect landing page

I want to know how to change the default landing page of an ADFS connected site after browsing to it from site selection. In the pic attached you can see I have a site called "My PHP Application" and ...
0
votes
1answer
2k views

SHIBBOLETH SP - Shibboleth handler invoked at an unconfigured location - Shibboleth.sso/Session/

I am trying to get shibboleth configured. When I go to https://mysite/secure/index.php, it works properly, I can authenticate, etc. but when I go to https://mysite/Shibboleth.sso/Status (or any other ...
0
votes
1answer
1k views

Try to reverse-proxy vsphere webclient with Apache

We want to protect our VMWare vsphere 6.5 web client with an already existing & working Apache 2.4 reverse proxy (benefits e.g. centralised monitoring, mod_security et.al.) Both communications ...
1
vote
1answer
221 views

Does Shibboleth IdP 3 automatically echo relay state by default?

Maybe this is a dumb question, but I can't find any anything about this in the documentation or elsewhere. According to the SAML spec, I know that the IdP is supposed to echo back the relay state ...
0
votes
1answer
247 views

Beginner ADFS SAML setup with Pingone

Have an external web application our company is going to use at a hosting company. They sent us the setup for PingOne invited SSO. Everything seems pretty straightforward. I began setting up our ADFS ...
1
vote
0answers
32 views

SAML Azure mappings

I'm trying to setup SocialCast to use SSO against Azure AD. I have everything working except I'm unable to map the fields for first name, last name, and email address. I know authentication is ...
4
votes
1answer
1k views

Using Google Apps / G Suite as IdP for Office365

I'm trying to set up SAML SSO where G Suite is the identity provider for Office 365 (service provider). Google's instructions are limited: https://support.google.com/a/answer/6363817?hl=en But I ...
3
votes
1answer
3k views

Can we configure ADFS for IDP initiated SSO

I'm looking for ways of integrating ADFS as a IDP for a SAML2 service provider. I have already configured the SAML2 provider with the verification certificates etc. And we used "Add Relying Party ...
2
votes
0answers
886 views

ADFS - Correct way to massively provision relying party trusts for many similar SAML service provider

Let's say I have 200+ sites in the form of: https://site1.example.com, https://site2.example.com I have to deploy an identical SAML configuration for all of these sites. Ideally I would just have a ...
3
votes
1answer
526 views

Where do I purchase token signing certificate for ADFS?

We are integrating with ADFS (SAML) with a customer. The customer requires us to obtain token signing certificate, trusted by well known CA. The certificate will be used to sign SAML requests that are ...
0
votes
1answer
1k views

SAML Remote Desktop Services Windows Server 2012R2

I want to implement SAML for Remote Desktop Services on Windows Server 2012R2. First, is it possible ? Then, I want to authenticate users from another AD with my RDS, like this architecture : https:/...
0
votes
1answer
54 views

SAML login from different URLs

I have an application which we have recently implemented the use of SAML for authentication. For most of our customers, all their users access the application from the same country. This is simple as ...
3
votes
1answer
724 views

Configuring Google Chrome to Connect to AD Configured with Kerberos and Using ADFS

I'm trying to configure Google Chrome (and Firefox) to authenticate using Active Directory tunneled through ADFS SAML/Kerberos Endpoints and an Apache application using Shibboleth. Here are some ...
0
votes
1answer
911 views

Cannot login to ADFS from service provider

Scenario User on AD client machine opens a browser and enters a https url to a service provider. Browser redirects to ADFS 3.0 IdP and the user is prompted to enter their AD user name and password. ...
1
vote
0answers
19 views

Reconfiguring MFA for SAML account

We use Office 365 SAML for authentication with NewRelic. I recently factory reset my phone and now don't have my Microsoft Authenticator account. I am trying to figure out how to set this up again ...
2
votes
2answers
751 views

Configuring Shibboleth SAML 2.0 with ADFS 3.0 with Fedration Errors

I'm trying to configure ADFS 3.0 and SAML 2.0. Currently, I get this error whenever I restart shibd and httpd. 2016-11-07 12:49:08 ERROR XMLTooling.ParserPool : error on line 1, column 2702, message: ...
2
votes
0answers
844 views

How to create an SPN for an ADFS server with an alias

I have a colleague who has set up an ADFS server in a test environment and that have given the ADFS server an alias. host name test-server.tdom.com alias test-adfs.tdom.com The server is running ...