Active Directory Federation Services (ADFS) is an identity access solution developed by Microsoft.

learn more… | top users | synonyms

0
votes
3answers
3k views

Authenticate WCF call to ADFS through Web Application Proxy (WAP)

Currently we authenticate WCF calls TO a service via ADFS, using the following procedure: Firstly, we get a SAML token from ADFS using (var factory = new WSTrustChannelFactory( new ...
1
vote
0answers
39 views

Authenticate with ADFS without Javascript?

I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS. Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
1
vote
0answers
172 views

Check if user is logged in on other ADFS authenticated site

I've been looking around for this specific situation, but so far no good.. We have multiple websites that use ADFS WSFederation, and we would like for a user to always pass through one, before being ...
7
votes
2answers
15k views

How to achieve seamless SSO without having the user to login again (SAML 2.0 & ADFS using OpenSSO)

We need to implement seamless SSO with ADFS SAML 2.0 using OpenSSO & we plan to go with IdP initiated GET binding. The user in client network will log in to ADFS with Windows credentials once ...
8
votes
1answer
2k views

ADFS: Verify requests from relying party

In ADFS, serveral certificates are used. This is explained (very clearly) on this page: http://blogs.technet.com/b/adfs/archive/2007/07/23/adfs-certificates-ssl-token-signing-and-client-authentication-...
3
votes
0answers
214 views

ADFS 3.0 OAuth2.0 against client applications

ADFS 3.0 does not support the Implicit Grant client flow of Oauth2, nor does it support client secrets. Initial investigations suggest it is not secure to use the Authorize Code Grant flow from a ...
4
votes
3answers
3k views

ADFS 2012 R2 (3.0) JSON web token validation

Our client would like for us to utilize ADFS 2012 R2 (aka 3.0) as the primary means for two security features in internal apps that we are building: The web app (there are two .NET & Angular) ...
3
votes
1answer
600 views

SAML Assertion to Windows Identity (Kerberos token?) transformation

This is the scenario I need to cover: A WebService that trusts on an IdP using Ws-Trust or any thing like that, receives a SAML token to authenticate the user, and we need to call some SQL Server or ...
0
votes
1answer
1k views

Best way to deal with cross-domain authentication in intranet

Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow? Overview on use-case, what we trying to achieve: Two servers, on two different domains; ...
2
votes
0answers
283 views

Mitigating the risk of disabling EPA on ADFS

I'm currently investigating the deployment of an Active Directory Federation Services (ADFS) server for providing Single Sign-on for various services. By default, ADFS enables support for Extended ...
2
votes
1answer
405 views

Is an ADFS “proxy” required in a production, Internet-facing ADFS deployment?

Is it acceptable to simply deploy ADFS, and expose 80/443 to the Internet, opposed to deploying redundant Front End and Back End servers? I understand that I'm missing out on Token Replay Attack ...
1
vote
0answers
315 views

Using a bearer token to get a federation token from ADFS

Why is it not possible to use a bearer token from an IdP STS to get ADFS (2.1) to issue a token? All issuedtoken endpoints require a symmetric or asymmetric key in the IdP token. Is there a specific ...
1
vote
0answers
77 views

Is it safe to store password in a session context? ADFS

I'm playing with adfs, and I'd like to store credentials in a session context during my questioning of the user. So, my question is, is it safe to store sensitive data in a session context? Thanks
7
votes
1answer
3k views

What are the security concerns with turning off Extended protection for authentication in IIS7 on ADFS?

In setting up SSO for Office 365, in order to make Chrome and Firefox access services on the Intranet, Extended Protection for Authentication must be disabled on the ADFS sever. As the ADFS server is ...
13
votes
4answers
5k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
5
votes
2answers
2k views

How do Azure ACS 2.0 security features compare to ADFS 2.0?

I'm configuring my relying party (a website) to use either ADFS or Azure ACS 2.0. ADFS 2.0 has some interesting features such as Token Replay prevention (in the SQL version) and may have other SAML ...
1
vote
1answer
384 views

What risk can untrusted WS-Federation metadata pose?

I'm adding support for SAML/ADFS/Azure ACS and read that untrusted metadata poses a risk. Considering that ADFS does background refreshes of the metadata, as do some RPs, can someone explain the risk,...
4
votes
1answer
587 views

How does the “Service Identity” feature of Azure ACS compare (and contrast) to a real IDP?

It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing? Some examples I'm thinking of ...