Skip to main content
6 votes
Accepted

AADSTS50107: Requested federation realm object does not exist, when integrating Okta as an IdP for AAD

First, make sure the integration is in fact set up correctly. To use Okta as an IdP for inbound federation to AAD for guest users, you'll want to create a new custom app in Okta: Create a web ...
Falcon Momot's user avatar
  • 25.4k
3 votes

How can I resolve "SAML Providers must reference at least one SAML assertion issuer" message?

In downloaded xml file change SPSSODescriptor to IDPSSODescriptor for both opening and closing tags. Also entityID should be "https://KEYCLOAK-URL/auth/realms/YOUR-REALMS-NAME"
Aftandil Kurolesov's user avatar
3 votes
Accepted

Sure of Valid Parameter set, Powershell Says: "Parameter set cannot be resolved..."

If you look carefully at the docs, you can see three parameter sets, If you look closely you will see that all the parameters except for 1 unique paramater. This 1 unique parameter also happens to be ...
Zoredache's user avatar
  • 132k
3 votes
Accepted

SHIBBOLETH SP - Shibboleth handler invoked at an unconfigured location - Shibboleth.sso/Session/

Found the answer: The problem was actually with the way Apache is configured. It was rewriting urls to add a / at the end of each url. so https://mysite/Shibboleth.sso/Session became https://mysite/...
Kevin Finkenbinder's user avatar
3 votes
Accepted

Combine apache auth providers of different types with basic auth only if proactively provided by client

Answering my own question.... dug around on this some more and came up with the following which seems to work: <Location /> <If "-n req('Authorization')"> AuthName "Active Directory" ...
Nathan Neulinger's user avatar
3 votes
Accepted

Can we configure ADFS for IDP initiated SSO

See https://blogs.technet.microsoft.com/askds/2012/09/27/ad-fs-2-0-relaystate/ and referenced articles for details
maweeras's user avatar
  • 2,744
3 votes
Accepted

Why do I get "InvalidNameIdPolicyException: MSIS7070" when authenticating via ADFS?

You need to add "Persistent name identifier" claim rules: Choose your Relying Party Trust and make a custom issuance transform rule to create unique user identifier claim. Then transform persistent ...
Bifeng Dong - MSFT's user avatar
3 votes
Accepted

Skipping unmapped SAML 2.0 attribute, even though name and nameFormat match

We were having the same issue. Apparently Shibboleth cannot mix the formats of SAML 1 and SAML 2. You have to use them as follows (https://wiki.shibboleth.net/confluence/display/SHIB2/...
Tom Desair's user avatar
2 votes

Steps for troubleshooting Windows ADFS issue

This looks promising: http://social.technet.microsoft.com/wiki/contents/articles/3910.extending-the-error-diagnostics-of-adfs.aspx One really helpful aspect of ADFS is that there is a code-level ...
Greg Askew's user avatar
  • 37.3k
2 votes

Purpose of "secure hash algorithm" option in ADFS relying party properties

Microsoft has already announced that they wouldn't be accepting SHA1 certificates after year 2016. So it's recommended that you use SHA2. However, there is possibility that some applications don't ...
Bifeng Dong - MSFT's user avatar
2 votes
Accepted

Where do I purchase token signing certificate for ADFS?

The token-signing certificate in ADFS does not care if you are using a SSL cert or code signing cert. The only requirement is the Key Usage should contain at least Digital Signature. Additionally, ...
Jimmy Sun's user avatar
  • 319
2 votes

Configuring Google Chrome to Connect to AD Configured with Kerberos and Using ADFS

There are different configurations for using the "system logon credentials" (Kerberos authentication mechanism) for Chrome and Firefox. Chrome To config chrome you need to start the application the ...
Andy Liu - MSFT's user avatar
2 votes
Accepted

single sign-on to multiple SAML SPs with one IdP

As SSO is usually part of a SAML setup, I'd suggest checking the IdP. It's the IdP's job to check whether the client has already signed in and report the same session to another SP. It might help to ...
fuero's user avatar
  • 9,809
2 votes

Combine apache auth providers of different types with basic auth only if proactively provided by client

Refering to the answer from @nathan-neulinger - using an apache <If> directive inside a <Location> can become a problem if you have exceptions to a general <Location>. Example <...
sastorsl's user avatar
  • 392
2 votes

Should the AD FS Federation metadata for a Relying Party Trust be publicly accessible?

No - it's designed to be publically accessible. There is no sensitive information. The certificates part is for the public keys only.
rbrayb's user avatar
  • 1,128
1 vote

Google App Engine and SAML (Okta)

The problem was simple enough: the reverse proxy configuration changes the HTTP request (HTTPS scheme to HTTP) which makes the Okta plugin (https://github.com/fangli/django-saml2-auth) fail with the ...
ModMed SysAdmin's user avatar
1 vote
Accepted

AD FS Not Authenticating SAML Requests

I doubt if this is an artefact resolution problem. I wonder if this is related to the fact that the ADFS certificates have rolled and the new certificates need to be distributed to the RP. O365 will ...
rbrayb's user avatar
  • 1,128
1 vote
Accepted

Redirect Google Authentication to Microsoft Authentication to use with SAML

If by "when I call an oauth2 login to google I get the google Login page first" you mean that you get the page where you have to enter the username, and after Google sees the user is from a domain ...
Liron's user avatar
  • 161
1 vote

Is there a claim type in ADFS that states if the authentication was performed on the private or public interfaces?

If you go to ADFS directly (as opposed as to via the WAP) you get the claim: http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork
rbrayb's user avatar
  • 1,128
1 vote
Accepted

The SAML authentication request had a NameID Policy that could not be satisfied.

I resolved this by changing the line- Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient", into Properties["...
soccer7's user avatar
  • 185
1 vote

Getting junk while accessing federationMetadata.xml on Windows server 2012 R2

Compatibility view settings in IE solved the issue for me.
rohitvk's user avatar
  • 11
1 vote

How can I remove or delete an outgoing claim in AD FS?

You don't control the ADFS you're talking about, do you? It's a third party's one (being the third party the client which you're developing an app for), isn't it? ADFS lets you (resp. the admin) ...
khlr's user avatar
  • 123
1 vote

Beginner ADFS SAML setup with Pingone

You are running into issues described in https://blogs.technet.microsoft.com/pie/2016/10/23/adfs-2016-cannot-addupdate-relying-party-from-the-gui-from-metadata-files/ See the same article for fix ...
maweeras's user avatar
  • 2,744
1 vote

.NET Issue on ADFS SSO behind a Reverse Proxy

You may need to deselect Reverse rewrite host in response headers in the ARR settings and additionally set preserveHostHeader="true" in applicationhost.config Open Internet Information Services (IIS) ...
Brandon Hixson's user avatar
1 vote

Azure AD SAML2 SSO issues wrong AuthnInstant in SAMLResponse

Is there a way to configure mu Office 365 to specify the time zone in the AuthnInstant correctly? To add to this, SAML timestamps are always in UTC. It's demanded by the protocol specifications, so ...
Tim van Dijen's user avatar
1 vote

Azure AD SAML2 SSO issues wrong AuthnInstant in SAMLResponse

I have found the problem. The Azure AD works fine here. The AuthnInstant is not the time when the SAMLResponse gets generated. It is a time when I had logged me in into my Office 365 last time. That ...
Sergey Shcherbakov's user avatar
1 vote

ADFS site selection redirect landing page

Have a look into SAML relaystate. If you send some relaystate to the PHP app that it understands, it can redirect to wherever you want. Note AD FS's responsibility here after authentication is to post ...
maweeras's user avatar
  • 2,744
1 vote

Configuring Shibboleth SAML 2.0 with ADFS 3.0 with Fedration Errors

I don't know if you had find the solution, but I've just encountered the same situation, and I have a workaround : In your shibboleth2.xml file, change the "validate" parameter to "false", like this : ...
Gilphe's user avatar
  • 11
1 vote

LDAP connector for SAML

I found a way! There is a platform called Foxpass, that does exactly that - it can forward LDAP authentication requests to Google and build a cloud ldap directory on top of that. It also features a ...
Adam Machnikowski's user avatar
1 vote

SAML authentication fails with error MSIS7075

It looks like signedsamlrequests=true is configured but you are not sending a signed SAML request to AD FS. When you run below command does it return TRUE? (get-adfsproperties)....
maweeras's user avatar
  • 2,744

Only top scored, non community-wiki answers of a minimum length are eligible