Hot answers tagged

4

Okay, I got it myself. Basically you can add the requireSession attribute to the Host attribute, these are handled globally and the Path attributes are there to overwrite global behavior like disable shibboleth auth on exception/ requests. <RequestMapper type="Native"> <RequestMap applicationId="default"> <Host name="mydomain" ...


4

First, make sure the integration is in fact set up correctly. To use Okta as an IdP for inbound federation to AAD for guest users, you'll want to create a new custom app in Okta: Create a web platform app using the SAML 2.0 signin method with these settings: Single sign on URL: https://login.microsoftonline.com/login.srf Use this for recipient URL and ...


3

If you look carefully at the docs, you can see three parameter sets, If you look closely you will see that all the parameters except for 1 unique paramater. This 1 unique parameter also happens to be be required. So for the commandlet Set-ADFSRelyingPartyTrust you must specify the target in one of three ways. You must have one of the following: -...


3

See https://blogs.technet.microsoft.com/askds/2012/09/27/ad-fs-2-0-relaystate/ and referenced articles for details


3

You need to add "Persistent name identifier" claim rules: Choose your Relying Party Trust and make a custom issuance transform rule to create unique user identifier claim. Then transform persistent identifier claim into Name Identifier claim. Detail steps by step and rule detail, you can check here


3

We were having the same issue. Apparently Shibboleth cannot mix the formats of SAML 1 and SAML 2. You have to use them as follows (https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute): SAML 1: urn:mace:shibboleth:1.0:attributeNamespace:uri (default) If you want to map an attribute with another format (but not a SAML 2 format), you ...


3

In downloaded xml file change SPSSODescriptor to IDPSSODescriptor for both opening and closing tags. Also entityID should be "https://KEYCLOAK-URL/auth/realms/YOUR-REALMS-NAME"


2

It looks like a number of things were wrong. Firstly, I didn't realize that the metadata needed to be recopied from my IdP back to the apache configs when I modified the SAML settings that side. Anyway, after making sure the IdP and SP xml files were configured correctly in Apache, I was able to move on (I think I had changed the entity ID) I was still ...


2

This looks promising: http://social.technet.microsoft.com/wiki/contents/articles/3910.extending-the-error-diagnostics-of-adfs.aspx One really helpful aspect of ADFS is that there is a code-level capability in the ASPX pages that ship with ADFS. These can be helpful for adding code to use a default home realm or alter the behavior of ADFS for custom ...


2

Microsoft has already announced that they wouldn't be accepting SHA1 certificates after year 2016. So it's recommended that you use SHA2. However, there is possibility that some applications don't support SHA2. In this case, you can contact the application vendor for new version which support SHA2. Otherwise, you have to select SHA1 here for these ...


2

The token-signing certificate in ADFS does not care if you are using a SSL cert or code signing cert. The only requirement is the Key Usage should contain at least Digital Signature. Additionally, if you use a non self-signed token signing cert, you will have to renew the cert manually for the relying parties so that they will trust the this cert when the ...


2

There are different configurations for using the "system logon credentials" (Kerberos authentication mechanism) for Chrome and Firefox. Chrome To config chrome you need to start the application the following parameter: auth-server-whitelist - Allowed FQDN - Set the FQDN of the IdP Server.Example: chrome --auth-server-whitelist="*aai-logon.domain-a.com" ...


2

As SSO is usually part of a SAML setup, I'd suggest checking the IdP. It's the IdP's job to check whether the client has already signed in and report the same session to another SP. It might help to know what IdP and what SAML profile you are dealing with, my experience is kind of limited to the WebSSO profile and Shibboleth as IdP and SP. Ok, so I'll try ...


2

Answering my own question.... dug around on this some more and came up with the following which seems to work: <Location /> <If "-n req('Authorization')"> AuthName "Active Directory" AuthBasicProvider ldap AuthType basic AuthLDAPMaxSubGroupDepth 0 AuthLDAPBindAuthoritative off AuthLDAPRemoteUserAttribute sAMAccountName ...


2

Found the answer: The problem was actually with the way Apache is configured. It was rewriting urls to add a / at the end of each url. so https://mysite/Shibboleth.sso/Session became https://mysite/Shibboleth.sso/Session/. It is always the minor things! Since the Apache configuration is necessary for another portion of the project, I changed the ...


2

No - it's designed to be publically accessible. There is no sensitive information. The certificates part is for the public keys only.


1

I doubt if this is an artefact resolution problem. I wonder if this is related to the fact that the ADFS certificates have rolled and the new certificates need to be distributed to the RP. O365 will not be affected because that uses OpenID Connect.


1

If by "when I call an oauth2 login to google I get the google Login page first" you mean that you get the page where you have to enter the username, and after Google sees the user is from a domain that has SAML SSO configured it redirects you to Microsoft, that's expected. Google needs to know which user is being authenticated to know where to redirect you. ...


1

If you go to ADFS directly (as opposed as to via the WAP) you get the claim: http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork


1

The problem was simple enough: the reverse proxy configuration changes the HTTP request (HTTPS scheme to HTTP) which makes the Okta plugin (https://github.com/fangli/django-saml2-auth) fail with the obscure error. Adding the ASSERTION_URL entry to the SAML2_AUTH dict in you settings.py Django file does the trick.


1

I resolved this by changing the line- Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient", into Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",


1

Compatibility view settings in IE solved the issue for me.


1

You don't control the ADFS you're talking about, do you? It's a third party's one (being the third party the client which you're developing an app for), isn't it? ADFS lets you (resp. the admin) define several Relying Party Trusts (RPT). You can then define individual Issuance Transform Rules for each RPT. So if there's a distinct RPT defined for your app, ...


1

You are running into issues described in https://blogs.technet.microsoft.com/pie/2016/10/23/adfs-2016-cannot-addupdate-relying-party-from-the-gui-from-metadata-files/ See the same article for fix details.


1

I don't know if you had find the solution, but I've just encountered the same situation, and I have a workaround : In your shibboleth2.xml file, change the "validate" parameter to "false", like this : <MetadataProvider type="XML" validate="false" file="/etc/shibboleth/FederationMetadata.xml"/> In my case, I'm able to be redirected on the login page ...


1

I found a way! There is a platform called Foxpass, that does exactly that - it can forward LDAP authentication requests to Google and build a cloud ldap directory on top of that. It also features a radius server as a bonus. I tested it a bit and it seems to work as advertised. So for those who plan on building a fully functional directory service on top of ...


1

It looks like signedsamlrequests=true is configured but you are not sending a signed SAML request to AD FS. When you run below command does it return TRUE? (get-adfsproperties).signedsamlrequestsrequired If yes, then use below command to turn it off and test again. set-adfsproperties -signedsamlrequestsrequired $false Ideally you should configure ...


1

Based on suggestions from a Windows Admin, I did the following which resolved the issue. Ensured W32Time service was using NTP (it wasn't) Ensure all updates were installed (they were) Ensure all services were running under a service account, not an domain controller account (they weren't) After making sure ADFS was running under the service account, ...


1

Based on suggestions from a Windows Admin, I did the following which resolved the issue. Ensured W32Time service was using NTP (it wasn't) Ensure all updates were installed (they were) Ensure all services were running under a service account, not an domain controller account (they weren't) After making sure ADFS was running under the service account, ...


1

I solved this by tweaking the [AdfsConfiguration].[IdentityServerPolicy].[Policies] table in the ADFS configuration database. There's a record that covers the inbound claims. On my database it's ID '88EDF726-83FA-E511-80C5-000D3AB14473' though I don't know if they're constant values or vary by deployment. You can tell which one it is as it's quite long and ...


Only top voted, non community-wiki answers of a minimum length are eligible