I am getting a strange error from ADFS 2.0 event Log as follows:
"The Federation Service could not fulfill the token-issuance request because the relying party 'https://my-relying-party' is missing a WS-Federation Passive endpoint address.
Relying party: https://my-relying-party
This request failed.
User Action
Use the AD FS 2.0 Management snap-in to configure a WS-Federation Passive endpoint on this relying party."
This happens after SAML response is verified successfully by ADFS 2.0 but apparently fails to issue a token for the relying party application.
I configured in ADFS 2.0 both IDP and SP as SAML 2.0 so I don't understand why is WS-Federation endpoint is expected?
Any help will be appreciated.
Is your web application talking the WS-Federation protocol or the SAML protocol (SAML-P)? If your web application is based on WIF, then you are using WS-Federation. Note that both protocols use SAML tokens.
If your application talks the WS-Federation protocol, then in your AD FS Relying Party Trust you need to set the WS-Federation endpoint(s). If it talks the SAML protocol, you need to set the SAML protocol endpoint(s).
Based on your error message, your application probably talks WS-Federation, therefore you need to set the WS-Federation endpoint.
The integration between your SAML 2.0 SP (ADFSv2) and your RP Application is done via WS-Federation Passive Requester Profile. So you'll need to setup your application to receive the WS-Fed Response and parse it appropriately. You'll also have to configure ADFSv2 to generate this message as well (per the error message you received).
Hope this helps -
Ian
You need to add the web application url to the endpoints in the properties of you relying party.
add ws-federation passive reference manually or in federation file will solve the problem.
Please let me know if you need detail guidance.
Related
The WS-Federation passive protocol endpoint and the SAML protocol endpoint cannot both be null.
I am the Identity provider and the SAML connection keeps giving me the above error when I try to test it.
In the ADFS wizard under the "Endpoints" tab, have you configured any endpoints?
Did you configure it via metadata or manually?
Did you enable support for SAML?
Have a look at these screenshots.
I have installed Zimbra Network Edition v8.8.8 and it is running fine. I am trying to configure SSO using simplesaml but I am stuck at the part where I have to pass the SAML response for the SSO. Quoting from https://wiki.zimbra.com/wiki/Authentication/SAML:
Note for SAML Provider
SAML Provider must POST the SAML Response at the following URL for
SSO:
<zimbra_base_url>/service/extension/samlreceiver
This SAML Consumer extension requires that the Subject Name Identifier
inside the SAML Assertion must be the account email address, so
configure the Provider accordingly.
I have tried to edit the saml20-idp-remote.php and include the Assertion Consumer Service (ACS) URL but I think the URL that I used was wrong. Or should I actually configure it in saml20-sp-remote.php file? I'm new to both SSO and Zimbra.
In the meantime I'll check out this (just found it):
SAML 2.0: How to configure Assertion Consumer Service URL
Appreciate all the help.
Thanks.
The Zimbra SAML extension provides support for the Browser/POST Profile of SAML.
https://sites.google.com/site/ranmanicwikii/opensource/zimbra-saml-sso
Hope this helps!
I am creating a java application to implement SSO (SAML) using ADFS. I am not sure if SAML can be done using ADFS alone. While installing ADFS, I noticed that it required configurations of relying party and claim providers trusts (which are basically the SP and IP, right?). I am confused as to whether to have SP and IP in the java application, or just leave it to the ADFS to handle.
Any help would be greatly appreciated. Thanks!
Your Java application needs a SAML stack and becomes the SP.
Refer: SAML : SAML connectivity / toolkit for some ideas if you don't have one.
ADFS (which handles SAML 2.0) can then function as the IDP.
You will also have to configure the claims in ADFS - which correspond to the SAML assertions.
Your Java application will be a Service Provider (SP) that receives identity from an Identity Provider (IdP) server. In the use case you have outlined, ADFS will be the IdP Server. within your application you will need to integrate a library (e.g. SAML stack) to process the SAML assertion. SAML requires configuration on both sides of the interface. There are a few open source options such as OpenSAML. Depending on your organization, you may want to look at a vendor provided solution as well for long term support.
I am very confused about my current ADFS setup. I have an identity provider that issues a SAML 2.0 token to ADFS 2.0 in an IDP-Initiated scenario. ADFS translates the token into WS-Federation, and forwards it on to a claims aware (WIF) web application. The web application, however doesn't recognize the user has having authenticated and redirects back to Home Realm discovery. I've used SAML Tracer in Firefox and I can see the SAML assertions going in and the WS-Federation claims in the parameters being sent to the web application. Is there a step I am missing? I set up custom claim rules to translate the SAML assertion into a WS-Federation claim (e.g. http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name) If I switch the SP application to a SAML 2 web app, then everything works fine.
So after comparing the headers of an IDP initiated request and an SP initiated request, I noticed a difference. The IDP initiated request was missing the wctx parameter. Once I included this in my relaystate, the WIF RP app worked fine.
wctx=rm%3D0%26id%3Dpassive%26ru%3D%252FMyDesiredStartPage.aspx
I'am are trying to implement a Web SSO with claim based identity using WIF and AD FS 2.0 right now. Right now I have a existing ASP.Net application which delegates authentification to the AD FS 2.0 server and trust issued security tokens. That works just fine.
However, in the organization there is an existing JA-SIG Central Authentication Service (CAS) server which supports the SAML 2 protocol. I would like to replace AD FS 2.0 with the existing CAS service.
In my understanding WIF uses WS-Federation, which is like a container around a SAML token. Is it possible to use the plain SAML 2 protocol and it's bindings (redirect or POST)? If that is not possible (as I guess), a second alternative might be to use federate identity and federate AD FS 2.0 with CAS. Is that possible? There is little to no information about that on the web.
Thanks :-)
After some research I came up with the following issues. CAS 3.x supports SAML 1.1 tokens and the SAML 1.1 protocol including Web SSO. There is support for SAML 1.1/2.0 tokens in ADFS 2.0. However, only the SAML 2.0 protocol is supported. That means no out of the box federation between CAS and ADFS 2.0 is possible.
We are researching OpenSSO as an alternative now, which provides support for all necessary protocols including WS-Federation for attaching WIF clients.
Access control Service v2 (ACS v2) may be an option. It supports both SAML1.1 and 2.0 as well in addition to other ones like simple web token (SWT) etc. It then allows to translate tokens from the source system to the relying party format..
https://portal.appfabriclabs.com/Default.aspx