ADFS as a SAML Service Provider interacting with other Relying Parties

0
votes

I have a web application that is capable of being a SAML 2.0 IdP as well as a SP, and have successfully implemented SSO between my platform and ADFS, but only when ADFS is the IdP.

This is my first foray into integrating with my platform, using ADFS as a SP and I'm having problems understanding the SSO flow.

In my situation, I have three players: WebApp (IdP), ADFS (SP), RelyingParty (S). The trusts are set up in ADFS, and the user experience is supposed to be a successful login to the RelyingParty having logged in to the WebApp

Setting up a new Claims Provider Trust in ADFS with my web app appear to work perfectly. I can go to my app's IdP-initiated URL which sends an unsolicited SAML message to ADFS's ACS URL. When I do this, I get redirected to /idpinitiatedsignon with the message "You are signed in" and a drop-down of the relying parties I've already set up.

If I click on the login button for the RP, ADFS generates a new AuthNRequest to my web app before eventually getting to the Relying Party.

So, seeing this behaviour, I have two questions:

  1. I would have thought that the initial sign in to ADFS via my IdP-initiated login would have got me though to my RP without the need for going back to the IdP for another sign-in. have I misunderstood, or have I just misconfigured ADFS?

  2. What mechanism is ADFS determining that my IdP is to be used? If I go to the ADFS /adfs/ls/idpinitiatedsignon.aspx page in a browser, I've not involved my IdP at all, and selecting my RP does use my IdP to authorize the user but I've no idea how this is determined since there's no link between the Trust Claims Provider and the Relying Party in ADFS configuration.

1
samladfs

1 Answers

0
votes
  1. What happens if you use loginToRp:

https://your-adfs-server/adfs/ls/IdpInitiated.aspx?loginToRp=your:relying:party:id

  1. You have chosen to use IDP Initiated to ADFS. So ADFS handles the authentication.

If you want to involve your IDP, you need to use SP-Initiated flow from the RelyingParty (S).

Then ADFS will show you the Home Realm Discovery screen and you can pick your IDP.