11
votes
Accepted
Keycloak blank page behind nginx reverse proxy
Your Nginx configuration looks fine. I recently had the same issue as you had and had more or less the same Nginx configuration.
The only thing I still needed to do is to update the standalone ...
- 1,441
10
votes
Accepted
Can ADFS connect to other SSO services?
I've done this. In our model, we have three sets of users:
Internal users authenticating via Active Directory (Kerberos or NTLM) against the local AD FS instance. In this set, the AD FS server runs ...
- 2,363
6
votes
Accepted
MIT Kerberos keeps asking for password when authenticating to OpenSSH
Root login
Judging from your supplied log files I would say that the attempted root login is not your issue here. Notice that all of the authentication attempts as root come from 218.65.30.30, a ...
- 365
5
votes
Apache2, Kerberos: gss_accept_sec_context() failed: An unsupported mechanism was requested
In a simple setup, using mod_auth_gssapi and FreeIPA as the krb5 server and to generate keytabs, I found out that adding the following next to the AuthType command addressed the issue.
BrowserMatch ...
- 51
5
votes
Accepted
ADFS Passive Request = "There are no registered protocol handlers"
Finally found the solution after a week of google, tries, server rebuilds etc!
(This guru answered it in a blink and no one knew it!
https://www.experts-exchange.com/questions/28994182/ADFS-Passive-...
- 181
5
votes
Can ADFS connect to other SSO services?
It seems that chaining relying parties is indeed possible. This guy has written a series of posts about it, here's one. You can use ADFS as the "hub" for your app to auth against, and it will chain ...
- 36.2k
5
votes
Can ADFS connect to other SSO services?
Yes, it can.
Each of these external IDP is added as a claims provider in ADFS and on the IDP side, ADFS is added as a Relying Party.
When you authenticate, ADFS will show a Home Realm Discovery ...
- 1,108
4
votes
Accepted
Azure AD SAML2 SSO wrong NameID format
In this doc they have a warning:
Azure AD currently supports the following NameID Format URI for SAML 2.0:urn:oasis:names:tc:SAML:2.0:nameid-format:persistent.
This is vague but I assume it means ...
- 4,833
4
votes
Security when working on a users laptop with their credentials
Do not ask for their password, that encourages bad habits. Users should know to never provide personal passwords to anybody.
As an administrator, you have visibility to most of their data, do things ...
- 32.1k
3
votes
How To Use Amazon Cognito As An SSO OpenID Identity Provider
I've encountered the same problem.
Unfortunately looks like OpenId Connect still isn't supported for Cognito User Pools and you'd need to use Identity Pools. On AWS Forum I've found following answer: ...
- 131
3
votes
Linux SSO for multiple windows domains
I've just hit the same issue as you, and thanks to this thread here, I've found the answer!
After turning on a second (trusted) realm in my mod_auth_kerb settings, and putting the right stuff in the ...
- 737
3
votes
Can I use Office365 or Azure AD as master record for Active Directory?
Microsoft recently started offering actual Active Directory services in Azure: https://azure.microsoft.com/en-us/services/active-directory-ds; if you only need centralized authentication, they can ...
- 70.4k
3
votes
Can I use Office365 or Azure AD as master record for Active Directory?
All of this information is old, I just wanted to help someone that was looking for it. Today 10/25/2016 I have 20 or so windows 10 laptops that connect and work with Azure AD services directly. It ...
3
votes
Accepted
Can we configure ADFS for IDP initiated SSO
See https://blogs.technet.microsoft.com/askds/2012/09/27/ad-fs-2-0-relaystate/ and referenced articles for details
- 2,734
3
votes
Accepted
How to force kerberos to use in memory credential cache?
As explained in the linked document, the memory cache is using MEMORY keyword so the following should do the job:
default_ccache_name = MEMORY:
But note that this type of ccache will be destroyed ...
- 9,805
3
votes
Sync AD from multiple on-premise server to Office 365
I suggest you read this MS article:
https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-topologies
Specifically this section:
Single forest, multiple sync ...
- 32.7k
3
votes
Accepted
SPN generation for multiple service account on a Web server
Yes, this is a fundamental issue with SPN's, you can't have more than one SPN for a URL on a single server. So in your situation where you different apps run under a single website and you need to use ...
- 38.8k
3
votes
How can I resolve "SAML Providers must reference at least one SAML assertion issuer" message?
In downloaded xml file change SPSSODescriptor to IDPSSODescriptor for both opening and closing tags. Also entityID should be "https://KEYCLOAK-URL/auth/realms/YOUR-REALMS-NAME"
2
votes
Bad SAML Request
We had same error, found that the x509 cert in the IdP Config wasn't imported or copied in correctly. We copied directly out of XML file into notepad, removed any spaces or line breaks and pasted ...
- 21
2
votes
Office 365 with Azure AD - can I allow SSO for another 3rd party SAML app externally?
it's a tale of two protocols, Office365 supports quick configuration of applications that support the OpenIDConnect protocol, it's likely you signed into this site with an OpenID provided by some ...
- 1,944
2
votes
Using Shibboleth with ADFS doesn't work
Did you follow this guide: AD FS 2.0 Step-by-Step Guide: Federation with Shibboleth 2 and the InCommon Federation?
It's old but the principles are still valid.
Hopefully, this will give you some ...
- 1,108
2
votes
Accepted
Splunk SAML SSO from an IdP with Apache mod_mellon fails
It looks like a number of things were wrong. Firstly, I didn't realize that the metadata needed to be recopied from my IdP back to the apache configs when I modified the SAML settings that side. ...
- 221
2
votes
Dynamics CRM with Windows Essentials AD + Azure AD
Take this with a grain of salt as I don't have a lot of exposure directly with the Essentials server.
The simplest setup for just the password management is to use Azure AD Sync (installed on ...
- 1,294
2
votes
AD FS 3.0 Event ID 364 while creating MFA (and SSO)
The Microsoft TechNet reference for ADFS 2.0 states the following for Event 364:
This event can be caused by anything that is incorrect in the passive request. It can occur during single sign-on (...
- 459
2
votes
ADFS and relying party web form
Your AD FS metadata URL should be provided to the relying party. Chances are they might allow you to do the relevant configuration yourself on some web portal. Your metadata URL is like below. replace ...
- 2,734
2
votes
Steps for troubleshooting Windows ADFS issue
This looks promising:
http://social.technet.microsoft.com/wiki/contents/articles/3910.extending-the-error-diagnostics-of-adfs.aspx
One really helpful aspect of ADFS is that there is a code-level ...
- 36k
2
votes
Accepted
Sharepoint Online auto acceleration not working
The issue is that the domain that was required for the SignInAccelerationDomain wasn't the domain used as the UPN for office 365 but the full domain name of the Windows domain. So i had to enable in ...
2
votes
Office 365 SSO with different internal and external domain names
When you sync with Office 365 your internal domain must be a routable address and this should be assigned to users UPN suffix. When you sync users you will then use the same logon as you would ...
- 1,294
2
votes
Office 365 SSO with different internal and external domain names
You need to add your external domain (email domain) as an alternate UPN suffix for internal Active Directory users.
To add UPN suffixes (from TechNet)
Open Active Directory Domains and Trusts. To ...
- 3,419
Only top scored, non community-wiki answers of a minimum length are eligible