wso2 : how to configure ADFS based authentication on per-tenant basis

1
votes

We are trying to use WSO2 IS 5.3 as IdP to perform SAML2 Web SSO for a multitenant SaaS app. We’d like to host a single instance of the app, register app as a service provider in WSo2 IS , create/manage tenants in WSo2 IS and configure different authentication means for each tenant.

In the POC we can successfully register our app as SaaS service provider and users from different tenants can login into App as soon as users are listed in the tenant’s primary or secondary user stores. However we cannot find info on how to configure ADFS based authentication on per- tenant basis (i.e. each tenant has its own IdP configured with ADFS based Federated authenticator. When user logs into app , WSO2 IS, based on customer’s domain name, would use IdP from corresponding tenant)

We followed this link and can set ADFS based authentication for superuser tenant and it works fine. (i.e. ADFS is configured as IdP for superuser tenant and we use Federated authentication in service provider associated with our app) ….

Question is how can we achieve the same but enable/configure ADFS based authentication on per-tenant basis?

Thank you in advance for comments/ideas !

1
wso2adfs
from wso2 documentation : "If your SAML2 SSO issuer has been configured in any other separate tenant other than super tenant, then you need to append the tenantDomain parameter as well. If the tenant domain is soasecurity.org, the GET request would be as follows: localhost:9443/…"... Now after adding tenantDomain into SAML request I'm able to authenticate using IdP configured for specific tenant. Curious whether WSO2 can parse user name, extract domain part and automatically use IdP configured for tenant..... – Alexey Shvechkov

1 Answers

0
votes

Update: we were able to configure ADFS on per customer basis(following steps from blog https://omindu.wordpress.com/2015/06/19/setting-ad-fs-3-0-as-federated-authenticator-in-wso2-identity-server/ ) and used tenantDomain parameter to differentiate b/w tenants during authentication.

In the final solution we made web app available to different tenants under different URLs . The app, based on the URL used to access it , would reconstruct and include tenantDomain parameter (as specified in WSO2 IS documentation ) into SAML request and that would effectively instruct WSO2 to use IdPs/auth means configured for that specific tenant for authentication