I try to configure my ADFS 4.0 (2016) on premise to send AuthNRequest to SamL 2.0 IdentityProvider (ClaimsProvider). The IdentityProvider needs to have AssertionConsumerServiceURL in the AuthNRequest
I tried to use several combinations of Set-ClaimsProviderTrust SamlAuthenticationRequestParameters but it does not include the required Attribute in ADFS AuthN Request send to IDP.
I used following Powershell to Update ADFS Claimsprovider
Set-ADFSClaimsProviderTrust -TargetIdentifier "https://idpsite/sps/sadidp01/saml20" -Name "MYIDP" -SamlAuthenticationRequestParameters "Url"
Microsoft Docs explaination for -SamlAuthenticationRequestParameters:
Specifies which of the following parameters to use in SAML authentication requests to the claims provider: AssertionConsumerServiceIndex, AssertionConsumerServiceUrl, and ProtocolBinding.
https://docs.microsoft.com/en-us/powershell/module/adfs/set-adfsclaimsprovidertrust?view=win10-ps
Sample AuthN request send from ADFS with missing AssertionConsumerServiceURL:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="id-4ba0a2a8-9d62-4dbe-94aa-709f6e188e07" Version="2.0" IssueInstant="2019-02-02T08:01:48.299Z" Destination="https://idpsite/was90ssl/b2bidp/saml2f" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified">
<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://myadfs/adfs/services/trust</Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
<ds:Reference URI="#id-4ba0a2a8-9d62-4dbe-94aa-709f6e188e07">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
<ds:DigestValue>voe5M2YqcIhQIVv77kOKe2cd3UQEaZDqqLuDeDZ7feE=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true" />
</samlp:AuthnRequest>
How can I include ConsumerAssertionUrl in ADFS AuthN request?
