Adding two claim providers with same certificates ADFS (SAML2.0)

Question

I have been trying to add a "virtual" claim provider (SAML 2.0 Identity Provider) in ADFS, I have another claim provider with same certicate. I get this error on ADFS2.0 in windows Server 2012

MSIS7600 Each Signing Certificate value for a claims provider Trust must be unique across all claims provider trusts in ADFS 2.0 configuration

Is there any workaround to avoid this issue?

Answer 1

No, I got the same thing here. Appearantly it must be unique. I tried to add 2 tenants (2 customers) coming from Windows Azure Active Directory where all claims of all tenants are signed with the same certificate.

The first one works perfectly but on the second one the MSIS7600 refuses to let me add the second Claims Party.

Answer 2

We had the same thing here and solved it by using this trick

• We created a new Azure AD with the purpose that this is the one we are going to add in ADFS.
• For each customer tenant we want users to be able to login, we asked asked for read permissions to this tenant; this way it it added in your own subscription. We then selected the users from the customer tenant and added it to the Azure AD we are going to use in ADFS.
• We connected ADFS to this Azure AD

All our customers can now login to the ADFS using their own credentials. The only thing we have to do is adding the existing Azure AD users from their own tenant to our Azure AD.

This way it let's you to add as many customers or external Ad's if you want and also not "showing" all tenants in the list of the ADFS page. Because there is only one tenant in ADFS there is no complain of the error MSIS 7600 and you don't have to update all tenants seperately.

Answer 3

Philippe is right. You can use AzureAD B2B feature that allows you to login in any Azure AD user in any tenant to be able to login. This is done by invite. This feature is in preview. This is the simplest choice. However, from an ADFS perspective, policy is on only a single entity. Home realm discovery can be a little more tedious.

We've also fixed ADFS 2016 to relax this constraint for a few reasons. We now constraint it on "Cert + claims-provider-identifier". In this world you will be able to add any # of Azure AD tenants distinctly. This fix will be out in the next preview (should be out soon).