I have configured ADFS 3.0 in my lab and trying to integrate with Salesforece. When I try to access the SalesForce using ADFS. It redirects me to ADFS login page which is expected behavior but after entering the credentials, it automatically redirect to internal IP Address instead of DNS name. I have checked on ADFS server but nothing found abnormal.
First URL (Login Page)
https://adfs.mycompany.com/adfs/ls/?SAMLRequest=
After entering the credentails, redirects to below URL
https://10.25.218.25/adfs/ls/?SAMLRequest=
Please help.
End point URL : https://i.stack.imgur.com/4k1cb.png
Related
I have next components:
RP-1 (connected by Ws-Fed, WIF)
RP-2 (connected by SAML, Federation Provider, actially it is another ADFS)
MY-ADFS (ADFS Server 2019 as primary STS)
MY-IP (separate Identity Provider web service, Identity Server 4)
Thus, when I make a sing-out request from RP-1(Ws-Fed), a simple Ws-Fed Logout is formed a request to ADFS:
GET https:/MY-ADFS/adfs/ls/
wtrealm: https://RP-1.com/
wa: wsignout1.0
wreply: https://RP-1.com/logout/
Next ADFS makes redirect to IP:
GET https://MY-IP/WsFederation
wa: wsignout1.0
wreply: https://MY-ADFS/adfs/ls/?redirectContextId=2dd581d2-6e02-4476-915b-a581e3c855d4
thus the user clears the session from ADFS and from IP. - as expected.
However, if before the logout, the transition to SAML RP was made and the SAML session became active, then upon exiting ADFS gives an error:
MSIS7055: Not all SAML session participants logged out properly. It is
recommended to close your browser.
To fix it, I configured the logout endpoint (URL) in the SAML relying party trust as:
https:/RP-2/adfs/ls/?wa=wsignout1.0
With POST binding. After these changes, the error disappeared. But now ADFS no longer does make Logout redirec to to IP, but instead it does a SAML Logout redirect to RP-2:
POST https://RP-2/adfs/ls/?wa=wsignout1.0
SAMLRequest: PHNhbWxwOkxvZ291dFJl
And as a result, Instead of switching to IP, I remain on the RP-2(ADFS also) page where it is written that the exit was successful. However, the user still has an active session (cookies) on the IP side.
Several questions here:
It is not clear why ADFS changes the chain of calls with the SAML active session.
It is not clear how to exclude SAML Logout redirects, or force ADFS to make Logout to IP also.
You will have to add the logout URL in the IP (Identity provider) side as well to ensure that the SAML token generated by signing out from the SaaS application through ADFS is forwarded to the Identity provider and is updated for logout at IP authorization provider end. So that, the cookie on the browser will be updated and sign out will be processed smoothly.
Please find the below probable steps to update the logout URL at the Identity Provider end: -
Open the authentication provider workspace.
Find the logout URL.
Update the URL to the ‘https://RP-2/adfs/ls/?wa=wsignout1.0’ same as that configured in ADFS Server.
Save your changes.
And as for your first query why ADFS changes the chain of calls with SAML active session, it is because the cookies and cache must be removed from the system for successful logout request, thus the logout time as recorded when signing out is updated at the SaaS app end and thus, it is recommended to close the browser let it update in the system also.
Thus, recommend you open both the RP trust apps in different browser windows as both are configured for different token providers.
Please refer the below thread for more information: -
How do you handle the logout process for applications federated with ADFS?
Thanking you,
I have configured the travelocity app to work running on a localhost with the Identity Server running on the local host. Works well
Then I rebuild the travelocity app to work with an external IS - changing the travelocity.properties
SAML2.IdPURL
OAuth2.TokenURL
OpenId.ProviderURL
to point to a public IS with valid SSL Certs
When I supplied https://www.mydomainname.com/commonauth in the Facebook "Valid OAuth redirect URIs" - the travelocity throws up an error "URL Blocked: This redirect failed because the redirect URI is not whitelisted in the app’s Client OAuth Settings. Make sure Client and Web OAuth Login are on and add all your app domains as Valid OAuth Redirect URIs."
with the redirect contain the IP Address of the server rather than the domain name of the server
When I supply the IP address for commonauth, it fails with "SAML2 Response Issuer verification failed " - I am assuming it is because the ssl certs doesn't match the ipaddress.
So why and where is the redirect-uri being converted to IP-Address?
And mainly how can I resolve this?
You need to change the SAML2.IdPEntityId property in the travelocity.properties to match the value of the
Residentity IDP --> Inbound Authentication Configs --> SAML --> SAML issuer value.
After you configure your IS with a hostname.
You can verify the steps you followed with the steps in blog [1].
Can I make logout account from openAM and redirect on my service?
I tried to send url like this http://myHost/OpenAM-12.0.0/UI/Logout?goto=myService, but OpenAM redirect me to SignIn-page. Can I solve this problem?
You have to set property iplanet-am-auth-valid-goto-domains for your org.
You can do it with ssoadm tool
From OpenAM Admin Guide:
Valid goto URL domains
List external domains to which clients can be redirected after authentication.
This attribute requires valid DNS domains that reflect the set policy rules,
such as (need more reputation to post more than 2 links, see in admin-guide).
ssoadm attribute: iplanet-am-auth-valid-goto-domains
Ping Federate Logout From IdP flow as from the Ping Federate Documentation
Sequence
User initiates a single logout request. The request targets the
PingFederate server’s /idp/startSLO.ping endpoint.
PingFederate sends a logout request and receives responses from all
SPs registered for the current SSO session.
PingFederate redirects the request to the IdP Web application’s
Logout Service, which identifies and removes the user’s session locally.
The application Logout Service redirects back to PingFederate to
display a logout-success page.
But, I have a slight problem regarding the application Logout Service , which needs to set at IdP adapter configuration.
The problem is i have dynamic logout URL , due to which i can't use it in the Logout Service.
Currently i am trying to initialize the IdP initiated SLO. For which i am passing TargetResource to redirect user to IdP after SLO success.
https://idp.pf.com:9031/idp/startSLO.ping?PartnerSpId=testSpId&TargetResource=http%3A%2F%2Fdynamicsubhost.baseurl.com%3A8080%2Fweb%2Fmy-bank%2Flogout
Question :
So how can i rig the PingFederate setting to skip the Step 3 , so instead of redirecting to the IdP Logout service it redirects to TargetResource.
What i have tried :
I know it sounds cheesy , but actually i kept the IdP logout service to blank. But obviously it wasn't working.
P.S The awkward thing is when i was using same PF server for
configuring both IdP and SP server it was working well. But when i
switch to separate instance of PF server for hosting the PingFederate
Server the consequence is showing up.
You may add the "resume" parameter in your logout service redirect. This is how I implemented it in .NET. I have a web service that handles the SLO and calls this redirect:
Context.Response.Redirect(< SP Server DNS > + Context.Request("resume").ToString(), True)
This redirect will instantiate the Logout service and then redirect back to the value of the targetResource parameter that you specified when you called the logout service.
If your targetResource does not have a value the default SLO URL will be used (this is set in the Admin Console: SP Configuration > APPLICATION INTEGRATION SETTINGS > Default URLs)
For reference: Just review the implementation of the sample application that you may download here
https://www.pingidentity.com/content/dam/pic/downloads/software/integration-kits/-NET-Integration-Kit-2-5-1.zip
I just read the article here: http://www.asp.net/aspnet/overview/developing-apps-with-windows-azure/building-real-world-cloud-apps-with-windows-azure/single-sign-on
I have just finished building an app that can authenticate users via WAAD, or via a local installation of ADFS on their corporate network (configuration point allows them to select one or the other).
The app will be hosted in Azure. Can someone tell me if it is possible for users who are on their corporate network to login to this Azure app WITHOUT entering their credentials?
Here is the flow:
user navigates to the cloud app
FAM detects they aren't authenticated, and redirects the browser to their ADFS server on the corporate network
ADFS server replies with 401 challenge (I assume this is what's happening)
user sees a user name/password box, and enters in credentials
user is redirected back to the cloud app with a token containing their claims
I don't understand why #4 is required if the user is already on their corporate network. Shouldn't ADFS use Windows Authentication here so they don't have to enter their password? Is there a way to configure ADFS to do this?
Thank you!
This can be accomplished by adding the Url of the ADFS endpoint to the local intranet or trusted sites of Internet Explorer. By default Internet Explorer will pass in the Windows credentials to sites in those two groups. If that doesn't work, you would have to double check that setting hasn't been modified.