1

I have a requirement to extend a quality assurance process in the customers CRM system so that when the user enters some data he or she is prompted to a screen with username and password and the already logged in user is again verified. You can think of it as a means of signing a document. We have to be sure that the person filling in the data is really the person logged in.

Now we use SSO with ADFS as the IDP. Thus my question: Is it possible to craft a SAML AuthNRequest with username and password and send it via POST request to the IDP and check the response for the authentification result?

I tried searching for an example AuthnRequest, yet from my understanding you are not supposed to send the username and password in the outgoing SAML.

Is there another way to verify the users SSO credentials for ADFS?

2 Answers 2

1

After some research I found a proper workaround for the requirement by leveraging the endpoint /adfs/services/trust/13/usernamemixed which can be used for validating ADFS user credentials.

This way there is no need to use the passive verification flow of the adfs/ls endpoint.

You can embed the user credentials in the following message and send it to the aforementioned endpoint. When validation succeeds ADFS will return an SecurityContextToken.

<s:Envelope
    xmlns:a="http://www.w3.org/2005/08/addressing"
    xmlns:s="http://www.w3.org/2003/05/soap-envelope">
    <s:Header>
        <a:Action>http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue</a:Action>
        <a:ReplyTo>
            <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
        </a:ReplyTo>
        <Security
            xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
            <UsernameToken>
                <Username>[email protected]</Username>
                <Password>password</Password>
            </UsernameToken>
        </Security>
        <a:To>https://adfs.url.com/adfs/services/trust/13/usernamemixed</a:To>
    </s:Header>
    <s:Body>
        <trust:RequestSecurityToken
            xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
            <wsp:AppliesTo
                xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
                <a:EndpointReference>
                    <a:Address>https://adfs.url.com/adfs/services/trust/13/usernamemixed</a:Address>
                </a:EndpointReference>
            </wsp:AppliesTo>
            <trust:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</trust:RequestType>
        </trust:RequestSecurityToken>
    </s:Body>
</s:Envelope>
0

No, you can't do that. (I think there is a SAML flow for authentication to the IdP that uses HTTP auth instead of the usual web forms, but it's really not meant for this... and really, one of the big advantages of SSO is that user credentials are never input into SP apps at any time.)

Instead, you can include the ForceAuthn option in your SAML request to ask the IdP to force re-authentication for the user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .