I am very confused about my current ADFS setup. I have an identity provider that issues a SAML 2.0 token to ADFS 2.0 in an IDP-Initiated scenario. ADFS translates the token into WS-Federation, and forwards it on to a claims aware (WIF) web application. The web application, however doesn't recognize the user has having authenticated and redirects back to Home Realm discovery. I've used SAML Tracer in Firefox and I can see the SAML assertions going in and the WS-Federation claims in the parameters being sent to the web application. Is there a step I am missing? I set up custom claim rules to translate the SAML assertion into a WS-Federation claim (e.g. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name) If I switch the SP application to a SAML 2 web app, then everything works fine.
SAML IDP and WS-Federation SP with ADFS 2.0
1.5k Views Asked by JGC At
1
There are 1 best solutions below
Related Questions in SAML
- WSO2 IS - Do a Single Logout using the IdentitySAMLSSOService
- OAuth & SAML integration or better approach
- SAML service provider signature verification
- How to generate saml 2.0 sso service metadata
- Mule ESB & PING Identity Integration
- Ensuring SAMLSecurityToken was not intercepted
- Simplesamlphp wrong metadata
- Is is possible to use Azure AD as a SAML compliant Identity Provider?
- SAML Authentication request to Gluu server
- AEM as IDP( Identity Provider) for CRM using SAML
- Disable SAML token authentication response digital signing
- SSO between native apps
- How do I debug my SSO SAML integration with zendesk
- Multi service with one-login authentication (Single sign-on)
- SimpleSAMLphp integration with asp.net web form application
Related Questions in ADFS2.0
- Disable SAML token authentication response digital signing
- Web Service Call for ADFS 2.0 Authentication
- Error while configuring ADFS as Identity Provider using SAML Authentication
- Active Federation for ADFS Proxy 2.0
- Getting error while fetch the page of ADFS
- Pass through incoming claims
- Azure Active Directory and WCF authentication
- ADFS Single Signout not working in Internet explorer 10
- How to create federation metadata XML for "Relying Party Trust" and "Claims Provider Trusts" for ADFS 2.0
- ADFS 2.0 claim rules for consuming SAML CA Site minder assertion
- asp.net MVC + Custom STS for Windows & SQL based mixed authentication (external and internal users)
- pingfederate as a adfs claim provider
- ADFS 2.0 Overcome Splash page
- ADFSv2.1 with aspnet mvc 5 redirect loop
- ADFS 2.0 MVC4 Get user information
Related Questions in CLAIMS
- Retrieve information from Bearer Token
- Group claims in roles ASP.Net Identity
- Excel report Generation in Guidewire claimcenter
- WSO2 Identity Server 5.0.0 fails to return user claims in SAMLResponse for user from secondary user store
- Shortest path tree claim (Graph)
- ADFS 2.0 claim rules for consuming SAML CA Site minder assertion
- ADAL JavaScript: Adding additional claims (ADAL JS)
- AUTH_USER, Claims, and Classic ASP
- Local STS to production
- Convert role in application to groupsid
- Why RP and IP communicates through browser instead of going directly?
- ADFS roles from SQL Server
- WIF with out using STS
- MVC5 AntiForgeryToken Claims/"Sequence contains more than one element"
- SAML IDP and WS-Federation SP with ADFS 2.0
Related Questions in WS-FEDERATION
- In WCF/WIF how to merge up claims from two different client's custom sts's tokens
- WS-Federation sign-in Asp.NET 5 MVC 6 ADFS
- OWIN based WS-Federation metadata endpoint for relying party application?
- Thinktecture single sign out
- Infinite redirection loop when using ws federation site and IIS url rewrite rules
- What is the relationship between wtrealm, WS-Federation Passive URL and app ID?
- Create a custom WS-Federation Identity Provider using a WCF service
- Losing WIF Claim with load balanced server
- Token based security strategy and considerations
- URL fragment lost as part of SAML token authentication; workaround / standard pattern?
- No Fedauth cookie are sent back as SAML token after reaching STS seems to miss XML tags. Happens only on Firefox
- Identity Server 4 Federation Gateway
- IdentityServer3 WS-Federation example Client and Server
- SAML IDP and WS-Federation SP with ADFS 2.0
- Is it possible to wire up external authentication after application startup?
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
So after comparing the headers of an IDP initiated request and an SP initiated request, I noticed a difference. The IDP initiated request was missing the wctx parameter. Once I included this in my relaystate, the WIF RP app worked fine.