Skip to main content
11 votes
Accepted

Keycloak blank page behind nginx reverse proxy

Your Nginx configuration looks fine. I recently had the same issue as you had and had more or less the same Nginx configuration. The only thing I still needed to do is to update the standalone ...
Thorchy's user avatar
  • 1,441
10 votes
Accepted

Can ADFS connect to other SSO services?

I've done this. In our model, we have three sets of users: Internal users authenticating via Active Directory (Kerberos or NTLM) against the local AD FS instance. In this set, the AD FS server runs ...
Mitch's user avatar
  • 2,353
6 votes
Accepted

MIT Kerberos keeps asking for password when authenticating to OpenSSH

Root login Judging from your supplied log files I would say that the attempted root login is not your issue here. Notice that all of the authentication attempts as root come from 218.65.30.30, a ...
rlf's user avatar
  • 365
5 votes

Apache2, Kerberos: gss_accept_sec_context() failed: An unsupported mechanism was requested

In a simple setup, using mod_auth_gssapi and FreeIPA as the krb5 server and to generate keytabs, I found out that adding the following next to the AuthType command addressed the issue. BrowserMatch ...
user457106's user avatar
5 votes
Accepted

ADFS Passive Request = "There are no registered protocol handlers"

Finally found the solution after a week of google, tries, server rebuilds etc! (This guru answered it in a blink and no one knew it! https://www.experts-exchange.com/questions/28994182/ADFS-Passive-...
Raheel Hasan's user avatar
5 votes

Can ADFS connect to other SSO services?

It seems that chaining relying parties is indeed possible. This guy has written a series of posts about it, here's one. You can use ADFS as the "hub" for your app to auth against, and it will chain ...
mfinni's user avatar
  • 36.3k
5 votes

Can ADFS connect to other SSO services?

Yes, it can. Each of these external IDP is added as a claims provider in ADFS and on the IDP side, ADFS is added as a Relying Party. When you authenticate, ADFS will show a Home Realm Discovery ...
rbrayb's user avatar
  • 1,128
4 votes
Accepted

How to force kerberos to use in memory credential cache?

As explained in the linked document, the memory cache is using MEMORY keyword so the following should do the job: default_ccache_name = MEMORY: But note that this type of ccache will be destroyed ...
Jakuje's user avatar
  • 10.1k
4 votes

Security when working on a users laptop with their credentials

Do not ask for their password, that encourages bad habits. Users should know to never provide personal passwords to anybody. As an administrator, you have visibility to most of their data, do things ...
John Mahowald's user avatar
3 votes
Accepted

Can we configure ADFS for IDP initiated SSO

See https://blogs.technet.microsoft.com/askds/2012/09/27/ad-fs-2-0-relaystate/ and referenced articles for details
maweeras's user avatar
  • 2,744
3 votes

How To Use Amazon Cognito As An SSO OpenID Identity Provider

I've encountered the same problem. Unfortunately looks like OpenId Connect still isn't supported for Cognito User Pools and you'd need to use Identity Pools. On AWS Forum I've found following answer: ...
krlm's user avatar
  • 131
3 votes

Can I use Office365 or Azure AD as master record for Active Directory?

Microsoft recently started offering actual Active Directory services in Azure: https://azure.microsoft.com/en-us/services/active-directory-ds; if you only need centralized authentication, they can ...
Massimo's user avatar
  • 71.7k
3 votes

Can I use Office365 or Azure AD as master record for Active Directory?

All of this information is old, I just wanted to help someone that was looking for it. Today 10/25/2016 I have 20 or so windows 10 laptops that connect and work with Azure AD services directly. It ...
Ahh ... It's a programming thi's user avatar
3 votes

Sync AD from multiple on-premise server to Office 365

I suggest you read this MS article: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-topologies Specifically this section: Single forest, multiple sync ...
TheCleaner's user avatar
  • 32.8k
3 votes
Accepted

Combine apache auth providers of different types with basic auth only if proactively provided by client

Answering my own question.... dug around on this some more and came up with the following which seems to work: <Location /> <If "-n req('Authorization')"> AuthName "Active Directory" ...
Nathan Neulinger's user avatar
3 votes
Accepted

SPN generation for multiple service account on a Web server

Yes, this is a fundamental issue with SPN's, you can't have more than one SPN for a URL on a single server. So in your situation where you different apps run under a single website and you need to use ...
Sam Cogan's user avatar
  • 38.9k
3 votes

How can I resolve "SAML Providers must reference at least one SAML assertion issuer" message?

In downloaded xml file change SPSSODescriptor to IDPSSODescriptor for both opening and closing tags. Also entityID should be "https://KEYCLOAK-URL/auth/realms/YOUR-REALMS-NAME"
Aftandil Kurolesov's user avatar
3 votes

Is there a solution to manage users in some systems or at least in linux?

You can use Active directory to authenticate users across different platforms including linux. For linux one possible solution is to use sssd. Here is one example how to use it. About storing keys you ...
Romeo Ninov's user avatar
  • 6,167
2 votes

Bad SAML Request

We had same error, found that the x509 cert in the IdP Config wasn't imported or copied in correctly. We copied directly out of XML file into notepad, removed any spaces or line breaks and pasted ...
Joe's user avatar
  • 21
2 votes

Office 365 with Azure AD - can I allow SSO for another 3rd party SAML app externally?

it's a tale of two protocols, Office365 supports quick configuration of applications that support the OpenIDConnect protocol, it's likely you signed into this site with an OpenID provided by some ...
Sum1sAdmin's user avatar
  • 1,964
2 votes

Steps for troubleshooting Windows ADFS issue

This looks promising: http://social.technet.microsoft.com/wiki/contents/articles/3910.extending-the-error-diagnostics-of-adfs.aspx One really helpful aspect of ADFS is that there is a code-level ...
Greg Askew's user avatar
  • 37.2k
2 votes

Office 365 SSO with different internal and external domain names

You need to add your external domain (email domain) as an alternate UPN suffix for internal Active Directory users. To add UPN suffixes (from TechNet) Open Active Directory Domains and Trusts. To ...
Sam Erde's user avatar
  • 3,489
2 votes

Office 365 SSO with different internal and external domain names

When you sync with Office 365 your internal domain must be a routable address and this should be assigned to users UPN suffix. When you sync users you will then use the same logon as you would ...
Jesus Shelby's user avatar
  • 1,304
2 votes
Accepted

Sharepoint Online auto acceleration not working

The issue is that the domain that was required for the SignInAccelerationDomain wasn't the domain used as the UPN for office 365 but the full domain name of the Windows domain. So i had to enable in ...
Ronan Thibaudau's user avatar
2 votes

Google Apps with AD FS 3.0 Sign out problems

The problem here is you've not been provided appropriate guidance from Google as to how to configure a SAML capable IDP such as AD FS to federate with Google apps. You should not be using adfs/ls/?wa=...
maweeras's user avatar
  • 2,744
2 votes

Purpose of "secure hash algorithm" option in ADFS relying party properties

Microsoft has already announced that they wouldn't be accepting SHA1 certificates after year 2016. So it's recommended that you use SHA2. However, there is possibility that some applications don't ...
Bifeng Dong - MSFT's user avatar
2 votes

SSO solution that would work with Amazon Simple AD and MS office 365

According to the related thread in AWS discussion forum here, the third-party solutions like Centrify can be used for Amazon Simple AD with Office 365 SSO. Though I haven't test it own, I think you ...
Jimmy Sun's user avatar
  • 319
2 votes
Accepted

Where do I purchase token signing certificate for ADFS?

The token-signing certificate in ADFS does not care if you are using a SSL cert or code signing cert. The only requirement is the Key Usage should contain at least Digital Signature. Additionally, ...
Jimmy Sun's user avatar
  • 319
2 votes
Accepted

How to change ccache type of MIT Kerberos

You'll want to alter the KRB5CCACHE environmental variable. Usually you'll do this for all instances in krb5.conf as follows: [libdefaults] default_ccache_name = KEYRING:persistent:%{uid} However, ...
84104's user avatar
  • 13.1k

Only top scored, non community-wiki answers of a minimum length are eligible