I am very confused about my current ADFS setup. I have an identity provider that issues a SAML 2.0 token to ADFS 2.0 in an IDP-Initiated scenario. ADFS translates the token into WS-Federation, and forwards it on to a claims aware (WIF) web application. The web application, however doesn't recognize the user has having authenticated and redirects back to Home Realm discovery. I've used SAML Tracer in Firefox and I can see the SAML assertions going in and the WS-Federation claims in the parameters being sent to the web application. Is there a step I am missing? I set up custom claim rules to translate the SAML assertion into a WS-Federation claim (e.g. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name) If I switch the SP application to a SAML 2 web app, then everything works fine.
So after comparing the headers of an IDP initiated request and an SP initiated request, I noticed a difference. The IDP initiated request was missing the wctx parameter. Once I included this in my relaystate, the WIF RP app worked fine.
wctx=rm%3D0%26id%3Dpassive%26ru%3D%252FMyDesiredStartPage.aspx
Related
We are using SAML 2.0 with ADFS hosted on Windows Server 2016. SSO is working. Users can successfully log into the ADFS identity provider and are redirected to the relying party and the SAML token is decrypted, assertions are read, and the user is successfully logged in. So far, so good.
SLO with ADFS and SAML 2.0 is not as clear. The OASIS specification (https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf) includes the following guidance on creating SAML 2.0 LogoutRequest. On page 33, the process for issuing the LogoutRequest is described as follows:
LogoutRequest issued by Session Participant to Identity Provider
In step 1, the session participant initiates single logout and terminates a principal's session(s) by
sending a LogoutRequest message to the identity provider from whom it received the
corresponding authentication assertion. The request may be sent directly to the identity provider
or sent indirectly through the user agent.
How is this step applied to ADFS? Specifically:
What endpoint on ADFS should the LogoutRequest be sent to?
If it is a POST request should the XML be submitted in the body? If not, how should it be packaged?
The majority of documentation we have found online that discusses SLO on ADFS uses WS-Federation rather than SAML 2.0.
ADFS's endpoint for SAML SLO is https://[your-adfs]/adfs/ls/
And yep, usually it's a POST containing the <samlp:LogoutRequest ... in its body.
See this answer for much more details.
We are acting as service provider (supporting SAML2.0) and we are working on a proposal to federate with a new federation whose IDP is ADFS2.0. We are currently supporting several other Federations that are currently using OKTA as their IDP.
We expect the IDP to post SAML assertion either through (SP initiated or IDP initiated). If ADFS2.0 is acting as IDP, will the SAML assertion will be similar to OKTA or will it be different? (I heard that the SAML assertion from ADFS2.0 will be compressed in addition to Base64 encoding while from OKTA it is only base64 encoded.)
You can expect both OKTA and ADFS to support the SAML2 standard.
If you are using the HTTP Redirect binding the xml is deflated+Base64-encoded. If you are using the HTTP POST binding the xml is only Base64-encoded. For receiving SAML2 assertions you shouldn't use the HTTP Redirect binding due to data length restrictions. So if you have a working implementation for OKTA it should work for ADFS too.
We would like to implement such additional configuration for SSO in our organization:
Web application (with SpringSaml) --- WSO2 IS 5.0.0 --- SimpleSaml as IDP for WSO2 IS.
Our working SSO configuration is:
Other Services --> SimpleSaml
Almost all works OK. But if I login to WSO2 IS from my application and from other service I login to SimpleSaml and that other service send LogoutRequest to SimpleSaml, WSO2 IS receive LogoutRequest from SimpleSaml but don't answer and WSO2 IS produces error:
ERROR {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator} - Context does not exist. Probably due to invalidated cache
I think, it is due to absence of sessionDataKey parameter in the logout request from SimpleSaml.
In IDP metadata for SimpleSaml I set a SingleLogoutService as
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://<server>:9443/commonauth"/>
Maybe it is not right URL. But I don't find SingleLogout URL for our configuration.
Could somebody help to resolve this problem or it is not possible to use WSO2 IS in such configuration?
Many thanks in advance!for
P.S. I'm very sorry for my english
What I understood from your comments that you have the setup of SimpleSamlPHP as your IDP which has connected to multiple SPs.Even the SimpleSamlPHP connected to WSO2 IS too.One of the SP send the Logout request to your SimpleSAMLPHP and the SimpleSAMLPHP pass the Logout request to WSO2 IS.
Let me describe how the logout request works on SP initiated Logout request.
LogoutRequest issued by SP to IDP
IDP determines authenticated SPs for given user session. If there are no SPs, other than the SP who sends logout request, the profile proceeds with step 5. Otherwise, steps 3 and 4 are repeated for each SP
LogoutRequest issued by IDP to SP
SP issues LogoutResponse to IDP
IDP issues LogoutResponse to SP who sends logout request.
The Logout URL you can make your custom URL where you want the user to redirect.
Refer the below Url to configure the external IDP to WSO2 IDP.
http://pushpalankajaya.blogspot.com/2014/09/leveraging-federation-capabilities-of.html
If you are using /samlsso end point in WSO2IS, It means that your are using SAML2 SSO. Therefore, you must send a proper logout request to the /samlsso end point. If you need to get more idea about SSO logout with SAML2 SSO, Please go through the below URL.
http://xacmlinfo.org/2013/06/28/how-saml2-single-logout-works/
UPDATE:
I was able to get ADFS to forward my user to the relying party application. I used ComponentSpace's SAML2.0 library and RelayState. Even though it successfully forwards to the WIF application, it doesn't recognize my user as having been authenticated. It instead initiates a SP-initiated SSO scenario by redirecting to the IDP STS. I'm not too sure how I should proceed.
Original Message:
I have configured a single-sign-on setup in the following manner:
IDP - A portal website that posts SAML2 responses to my SP.
SP - ADFS 2.0 configured with a claims provider trust configured as a SAML2.0 endpoint (with my IDP of course)
RP Application - An ASP.NET application which is configured as a Relying Party trust in ADFS (WS-Fed).
When I log into my IDP and click on the link that posts the SAML2 token to ADFS, everything works fine. I am taken to the IdpInitiatedSignOn.aspx page and am told that I have been logged in. The problem is that where I would normally expect to see a drop down list of applications to choose from (which should only include my single RP Application) I see nothing. I only have two buttons allowing me to sign out of all applications or a single application. Is there some trick to configuring the RP Application trust that I'm not aware of? It was my understanding that ADFS 2.0 would accept this configuration of SAML2 and WS-Fed. (See http://blogs.technet.com/b/askds/archive/2012/09/27/ad-fs-2-0-relaystate.aspx under "When can I use RelayState?")
I would greatly appreciate any advice on this.
IdpInitiatedSignOn shows the list of RP's that support SAML.
Your RP is WS-Fed so won't appear in the list. In your case, the path is:
RP -> WS-Fed -> ADFS (Home Realm Discovery) -> SAML -> IDP -> Authenticate.
I have a working ADFS machine. I want to construct a passive request that will generate a saml 2.0 token.
the following request for saml 2.0 token:
https://adfstest.cld.sr/adfs/ls/?wa=wsignin1.0&wtrealm=https%3A%2F%2Flocalhost%2FPro%2FFederatedLogin.mvc&wauth=urn:oasis:names:tc:SAML:2.0:am:password
generates the error: "Microsoft.IdentityServer.Protocols.Saml.NoAuthenticationContextException: MSIS7040: None of the requested authentication types are supported by the server."
yet if I change the request to a request for saml 1.0:
https://adfstest.cld.sr/adfs/ls/?wa=wsignin1.0&wtrealm=https%3A%2F%2Flocalhost%2FPro%2FFederatedLogin.mvc&wauth=urn:oasis:names:tc:SAML:1.0:am:password
It works but the token generated by ADFS is SAML 1.0.
What is the correct form to construct a request for passive federation with SAML 2.0 tokens?
AD FS 2.0 does not support SAML 2.0-based IDP-initiated SSO to a WIF relying party application.
The url you used in a ws-federation request and as such only saml 1.1 will be returned by ADFS.