Questions tagged [saml]

SAML (Security Assertion Markup Language) is an open standard and XML-based markup language for exchanging authentication and authorization information between parties, known as service providers and identity providers.

Filter by
Sorted by
Tagged with
0
votes
1answer
60 views

Auth Mellon is not redirecting to IDP. Apache is returning 404 for /mellon

I am trying to enable auth mellon for on-prem weblogic app. I have apache httpd and auth mellon installed on RHEL 6.8. I followed instructions as per https://github.com/Uninett/mod_auth_mellon/wiki/...
2
votes
1answer
374 views

AADSTS50107: Requested federation realm object does not exist, when integrating Okta as an IdP for AAD

I'm trying to set up AAD with Okta, and find that when users visit the App Embed link and it posts their SAML response to https://login.microsoftonline.com/login.srf, they get an unhelpful error: ...
0
votes
0answers
49 views

Subversion Server with Azure AD SSO

There is a running CollabNet Subversion Edge Server in the current version 5.2.4. It is currently connected with LDAP for authentication. Now there is a challenge to grant permission to b2b guests of ...
1
vote
0answers
13 views

Why don't identity providers have separate IDs and Names in Openstack?

I think most of the things have a separate ID and a separate Name in Openstack (Users, Projects, virtual machines, etc). Why don't identity providers have separate IDs and Names? Are there other ...
0
votes
0answers
52 views

Why isn't Kerberos used for SSO to cloud apps?

When comparing Kerberos to SAML, a common argument on StackOverflow sites and the rest of Internet is that SAML is for Internet / cloud applications while Kerberos is for enterprise LAN. There are ...
1
vote
0answers
19 views

Integrating GitHub Org with SAML shibboleth & post actions

I am at the beginner level of GitHub cloud administration and looking for answers to the below-listed questions after I enable SAML integration (Shibboleth) for my Github cloud Organisation. Before ...
0
votes
0answers
33 views

ADFS can't communicate with TLS1.2

I try to configure ADFS with gitlab to use SAML. My gitlab server have certificate signed by Active Directory. From Internet Explorer, I can open this url "https://gitlab-adfs../users/auth/saml/...
-1
votes
1answer
32 views

how we can generate the single sign on and reply url for new application in azure active directory

I am going to register a new application in the Azure active directory for SAML login. How can I generate my reply URL and single sign on url and entity ID ?
0
votes
0answers
20 views

Graph API PATCH Application Encryption certificate update

Attempting to update Encryption certificate using Graph API in Azure. PATCH: https://graph.microsoft.com/beta/applications/20a55f23-4de3-45d2-afcf-6e97b40f438z Payload: { "keyCredentials": [ ...
0
votes
0answers
18 views

Is there any command line tool or SDK to create a SAML app in GSuite?

I have been trying to search for any possible way to create SAML apps in GSuite with command line tools (programmatically). Anything even with Curl, Python, Ansible or any other scripting language. We ...
0
votes
0answers
18 views

Is it possible to trigger API or function calls when a user is created in Azure AD?

We have a handful of Azure AD domains that we are soon to be using as IdPs with a centralizing identity broker. For business and legal reasons we will not be combining these domains, establishing ...
0
votes
0answers
40 views

AAD / SAML for AD groups - group limit in azure

Signing in via Azure AD throws this error. { "code" : "InvalidParameter", "message" : "SAML token contains 145 groups, limit is 100" } I assume I need to do a ...
1
vote
1answer
59 views

Where does Chrome fetch my identity from after having deleted cookies?

I'm trying to figure out where does Google CHrome fetch my identity from when authenticating to an Identity Provider (SAML with certificate authentication) What I have tried : Delete all cookies, ...
1
vote
0answers
24 views

Windows ADFS User Certificate URL

I have setup a window lab server based on windows server 2012 r2. I have an AD, ADFS and CS. I have setup User certificate enrollment. Everything work fine but I have a litle issue. I have setup ADFS ...
0
votes
0answers
947 views

How to configure Azure SAML authentication for Rapid7 InsightVM / nexpose

I'm trying to use Azure AD SAML for authenticating to Rapid7 InsightVM (Nexpose) I have the Enterprise Application registered in AAD, with the EntityID provided from the InsightVM configuration. The ...
0
votes
0answers
36 views

F5 BIG-IP APM with SAML on simplesamlphp

I have configured the F5 BIG-IP for SAML authentication. My IDP is simplesamlphp. I have configured SAML SP Provider and External IDP connector and connected it to Virtual Server. On simplesamlphp I ...
0
votes
1answer
27 views

SAML sync users

Currently we are using SAML SSO, the client starts the Azure Enterprise App, provides us with tenantId, appId, certificate, and its users can log in to us through their Microsoft account. Can we use ...
1
vote
1answer
1k views

ADFS - How to send sAMAccountName without domain

I'm using ADFS and I need to send the sAMAccountName. Currently using a "Transform an incoming claim" rule: Incoming claim type: Windows account name Outgoing claim type: Name ID Outgoing ...
0
votes
1answer
691 views

IDP initiated SSO does not works on Win server 2016

I am trying to setup IdP initiated SSO on Windows Server 2016. I have configured the Relying party trust and the claim rules as well. I enabled the IdP Sign on page following - https://docs.microsoft....
0
votes
0answers
810 views

SAML with mod_auth_mellon results in error: Error processing authn response. Lasso error: [-432]

I have a issue with implementing SSO against ADFS with an Apache HTTPD Webserver using mod_auth_mellon. The error I get after authentication has been actually succeeded is: Apache HTTPD returns a HTTP ...
2
votes
2answers
596 views

How can I resolve “SAML Providers must reference at least one SAML assertion issuer” message?

I want to setup a SSO solution using Keycloak 10.0.2 as the Identity Provider. The first application I want to setup is AWS. I followed this tutorial to enable Keycloak to sign me in using SAML. I ...
0
votes
1answer
92 views

AzureAD IDP Initiated SAML always return nameid-format:persistent instead of nameid-format:emailAddress

I'm developing SSO using SAML and my IdP is Azure. I'm having problem with IDP Initiated flow. In SAML Response I always get this NameID: <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:...
0
votes
1answer
622 views

Configure AWS SSO with Auth0 as IDP

I am trying to configure “AWS SSO”'s to work with Auth0 as an External Identity Provider. I have made is to the point where I am getting the auth0 login as success but AWS throws me an error. error I ...
1
vote
1answer
3k views

AD FS Not Authenticating SAML Requests

This morning, it was brought to our attention that Active Directory Federation Services has stopped performing SAML authentications for all SAML-based relying party trusts (about 8 of them). Office ...
0
votes
1answer
67 views

Redirect Google Authentication to Microsoft Authentication to use with SAML

At this point I have an issue where I want to login to Google Identity's assets but using Azure AD as the IdP (Identity Provider). I already have the whole SAML environment setup with google as the ...
0
votes
1answer
14 views

Is there a claim type in ADFS that states if the authentication was performed on the private or public interfaces?

Although I don't recall the correct terminology, my understanding is that a particular relay application may be provisioned separately for intranet only, or both intranet and internet. I would be ...
4
votes
1answer
486 views

Sure of Valid Parameter set, Powershell Says: “Parameter set cannot be resolved…”

I'm attempting to run a Powershell cmdlet that only accepts one of three specific parameters. I'm positive that I know what those parameters are, and that I am entering those parameters correctly. I ...
0
votes
1answer
77 views

Is there an SSO mechanism supported as widely as LDAP?

LDAP is pretty amazing. It lets you set up a bunch of web services that all share a common user database (or rather, directory), so you can have a WordPress installation, a NextCloud, a MediaWiki etc, ...
2
votes
0answers
1k views

How to download SAML XML metadata from Microsoft Azure

I have an enterprise application that implements SAML SSO, and I have a new client who wishes to use it. This feature works with other clients. However, the application requires that the client ...
0
votes
2answers
458 views

Google App Engine and SAML (Okta)

We're trying to setup a web app (django) in Google App Engine connected via SAML to our idP, Okta. It has to be done as a Custom Flexible App because of a binary requirement, making it basically a ...
2
votes
0answers
96 views

AADSTS700517 using AWS Cognito and Azure AD Enterprise App

I have configured an AWS Cognito UserPool to use an Azure AD Enterprise Application as a SAML federated identity provider as per the blog post here: https://medium.com/the-apps-team/how-to-add-azure-...
1
vote
1answer
322 views

Set an attribute as MellonUser on mod_mellon

I'm failing to setup MelonUser on my Apache configuration. The NAME_ID my IdP provides in really a session ID that changes every time, and it's the only data available in the Subject of the response. ...
2
votes
1answer
114 views

ADFS Alternative questions

We had (Before it went belly up) an ADFS server that was simply doing a translation from SAML 2.0 to WSFED (My end point software can not take in SAML only WSFED). My question is, what are the ...
0
votes
0answers
153 views

Is G Suite as a SAML IdP a replacement for Okta?

G Suite supports acting as the identity provider to SAML-compatible service providers, in the same way as Okta does. However, you pay a premium for Okta whereas Google SAML is included in the G Suite ...
0
votes
1answer
777 views

adfs giving error on authnrequest message

I have a SAML2 service provider and am trying to set up SSO with an ADFS identity provider. Currently my service provider is only working with Okta and OneLogin. When they initiate the ...
1
vote
1answer
200 views

Should the AD FS Federation metadata for a Relying Party Trust be publicly accessible?

If I am a relying party, I can expose federation metadata to ease configuration for AD FS so I can import it into the Create a Relying Party Trust wizard. I can also choose to enable automatic updates ...
0
votes
2answers
5k views

The SAML authentication request had a NameID Policy that could not be satisfied.

I'm using Issuance Policy as: Rule 1: Rule 2 (custom): c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/...
0
votes
0answers
2k views

SAML error for SSO with ADFS - MSIS0038: SAML Message has wrong signature

Hi I am trying to use SSO to authenticate my client's users directly to my website. My client's IDP is Microsoft ADFS and I am using Passport-SAML (https://github.com/bergie/passport-saml) to ...
0
votes
1answer
400 views

Combination SAML and SSL Offloader causes error

Last night we tried to migrate a website to our new hosting provider. This new hosting provider uses a SSL offloader and this causes a problem with a website using SAML. After the migration when we ...
2
votes
1answer
1k views

ADFS: Convert SAML Assertion to OAuth Token?

We have Microsoft Active Directory Federation Services (ADFS) as our authentication/federation provider. We use it for performing identity federation via SAML to several external vendors, SaaS ...
0
votes
1answer
985 views

Getting error “Oops, this link isn’t working…” in the browser when testing a SAML SSO configured in Azure AD as non-gallery application

I have configured a non-gallery application in order to set up SAML for one of our clients. To the best of our knowledge, all the settings are properly set - I'm just this is just a basic mistake or ...
1
vote
2answers
1k views

Signature verification for InCommon SAML metadata using xmlsec1 fails

InCommon Federation provides IdP and SP metadata. Their refresh policy recommends frequent checking of the metadata aggregate to use the most recent version. They strongly recommend InCommon SPs ...
2
votes
0answers
3k views

How should the relying trust be set up in ADFS for SAML-based SSO?

We've done SAML-based SP-initiated SSO with a number of customers, and it's all been ok (eventually). We've got a customer now who's using ADFS. We can get idP-initiated to work fine, but with SP-...
0
votes
1answer
618 views

Getting junk while accessing federationMetadata.xml on Windows server 2012 R2

I have setup ADFS on windows server 2012R2 using self signed certificate. ADFS has been installed successfully. But when I try to access the federationMetadata.xml using https:///FederationMetadata/...
1
vote
1answer
76 views

customise saml attributes Azure AD

I have configured SAML SSO against a new app in my Azure Console. I have proven it authenticates using simplesamlPHP. I am trying to add/adjust the attributes that are passed back with the SAML token. ...
0
votes
1answer
2k views

How can I remove or delete an outgoing claim in AD FS?

My client's claims issuance rules for a relying trust don't include this claim, but it ends up in the outgoing claims and crashes Okta: http://schemas.microsoft.com/2012/01/devicecontext/claims/...
2
votes
1answer
598 views

single sign-on to multiple SAML SPs with one IdP

Part of our site, say https://www.example.com/files, is protected by mod_auth_mellon, which provides an SP that authenticates with our IdP. This works fine. The rest of the site is Drupal with the ...
0
votes
1answer
788 views

Shibboleth IdP won't start with Jetty 9.3

I've been following this guide to install Shibboleth Identity Provider 3.3.2 on Jetty 9.3.22 (Ubuntu Server 16.04 with Oracle JDK 8u151). At https://my.server.ip/idp I get a 503 error (Service ...
2
votes
1answer
1k views

Combine apache auth providers of different types with basic auth only if proactively provided by client

I'd like to be able to have a path on an apache server (2.4.18+ on ub16) that primarily authenticates using SAML (using the mod_auth_mellon plugin) for interactive use, but also supports having the ...
1
vote
1answer
11k views

Specify MFA based on user-agent in AD FS?

Is it possible to force a specific MFA provider based on a user-agent (ideal) or IP address (less ideal) in AD FS? Alternatively, is there another free SAML IdP that would allow this? Read below for ...