Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [adfs]

Active Directory Federation Services (ADFS) is an identity access solution developed by Microsoft.

0
votes
1answer
141 views

What a malicious user could do with a refresh token that cannot be revoked and has 1 year expiry time?

In ADFS 4.0 a refresh token cannot be renowed without passing through an authorization request flow (asking the user again for credentials) and cannot be revoked. I'm forced to put a 1 year lifetime ...
1
vote
1answer
70 views

How to protect a login page redirect

I have several web based applications that will redirect unauthenticated users to an ADFS sign-in page. ADFS will subsequently redirect users back to a web application once authenticated with a token. ...
2
votes
2answers
270 views

Solutions for accessing webapp from inside and outside the corporate perimeter by same users?

I'm looking for solutions that could best address the following requirements. We plan to develop a webapp and deploy it in the cloud. Corporate users must be able to access the webapp from the ...
0
votes
1answer
135 views

What do I need to ask 3rd party to add trust

We have ADFS and want to add a 3rd party application as trusted to it. I have certificate and metadata (xml) URI to give them but want to have a checklist what they need to give me. So far HTTP ...
-1
votes
1answer
737 views

windows authentication vs ADFS

I have an ASP.NET website hosted on premises and only accessible by my company. I discovered that if I connect it to a server in the DMZ (open to the internet) even though the IIS folder is set to ...
2
votes
1answer
231 views

Adfs saml credential provider

Wanted to see if the following is feasible or is there a way out? My situation, computers have internet access always (assumption) I want to write a credential provider with a browser embed and talk ...
0
votes
1answer
914 views

ADFS Self-signed Certificate

I can't find an answer to this, so I'm hoping you good people will know. I'm about to install ADFS into Production including a Web Application Proxy in the DMZ. When WAP is joined to a farm or a ...
3
votes
1answer
838 views

How to properly handle security certificates in asp.net (ws-federation)

So I'm setting up single-signon authentication for the organization I work for. Our IT guy has setup an ADFS server, which is where we're getting our logon credentials from. He's using an in-house ...
1
vote
1answer
183 views

ADFS claims consolidation from different issuers

I hope I understand the claims concept in general now after reading related articles on ADFS, certificates used for claims token signing etc. But here is what strange for me: Claims are so abstract ...
1
vote
1answer
358 views

ADFS with multiple IDP stops doing the SSO [closed]

I'm facing an issue when we enable a second IDP (add Claims Provider Trust), then we are not able to navigate between apps without stopping in the HRD (Home Realm Discovery) page. Is there a way to ...
2
votes
0answers
227 views

Authenticate with ADFS without Javascript?

I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS. Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
2
votes
0answers
496 views

Check if user is logged in on other ADFS authenticated site

I've been looking around for this specific situation, but so far no good.. We have multiple websites that use ADFS WSFederation, and we would like for a user to always pass through one, before being ...
4
votes
1answer
985 views

ADFS 3.0 OAuth2.0 against client applications

ADFS 3.0 does not support the Implicit Grant client flow of Oauth2, nor does it support client secrets. Initial investigations suggest it is not secure to use the Authorize Code Grant flow from a ...
0
votes
1answer
4k views

Best way to deal with cross-domain authentication in intranet

Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow? Overview on use-case, what we trying to achieve: Two servers, on two different domains; ...
2
votes
0answers
394 views

Mitigating the risk of disabling EPA on ADFS

I'm currently investigating the deployment of an Active Directory Federation Services (ADFS) server for providing Single Sign-on for various services. By default, ADFS enables support for Extended ...
2
votes
1answer
1k views

Is an ADFS “proxy” required in a production, Internet-facing ADFS deployment?

Is it acceptable to simply deploy ADFS, and expose 80/443 to the Internet, opposed to deploying redundant Front End and Back End servers? I understand that I'm missing out on Token Replay Attack ...
4
votes
1answer
2k views

SAML Assertion to Windows Identity (Kerberos token?) transformation

This is the scenario I need to cover: A WebService that trusts on an IdP using Ws-Trust or any thing like that, receives a SAML token to authenticate the user, and we need to call some SQL Server or ...
4
votes
3answers
9k views

ADFS 2012 R2 (3.0) JSON web token validation

Our client would like for us to utilize ADFS 2012 R2 (aka 3.0) as the primary means for two security features in internal apps that we are building: The web app (there are two .NET & Angular) and ...
1
vote
0answers
667 views

Using a bearer token to get a federation token from ADFS

Why is it not possible to use a bearer token from an IdP STS to get ADFS (2.1) to issue a token? All issuedtoken endpoints require a symmetric or asymmetric key in the IdP token. Is there a specific ...
0
votes
2answers
6k views

Authenticate WCF call to ADFS through Web Application Proxy (WAP)

Currently we authenticate WCF calls TO a service via ADFS, using the following procedure: Firstly, we get a SAML token from ADFS using (var factory = new WSTrustChannelFactory( new ...
8
votes
1answer
5k views

ADFS: Verify requests from relying party

In ADFS, serveral certificates are used. This is explained (very clearly) on this page: http://blogs.technet.com/b/adfs/archive/2007/07/23/adfs-certificates-ssl-token-signing-and-client-authentication-...
1
vote
0answers
107 views

Is it safe to store password in a session context? ADFS

I'm playing with adfs, and I'd like to store credentials in a session context during my questioning of the user. So, my question is, is it safe to store sensitive data in a session context? Thanks
9
votes
3answers
40k views

How to achieve seamless SSO without having the user to login again (SAML 2.0 & ADFS using OpenSSO)

We need to implement seamless SSO with ADFS SAML 2.0 using OpenSSO & we plan to go with IdP initiated GET binding. The user in client network will log in to ADFS with Windows credentials once ...
8
votes
1answer
5k views

What are the security concerns with turning off Extended protection for authentication in IIS7 on ADFS?

In setting up SSO for Office 365, in order to make Chrome and Firefox access services on the Intranet, Extended Protection for Authentication must be disabled on the ADFS sever. As the ADFS server is ...
15
votes
4answers
6k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
1
vote
1answer
635 views

What risk can untrusted WS-Federation metadata pose?

I'm adding support for SAML/ADFS/Azure ACS and read that untrusted metadata poses a risk. Considering that ADFS does background refreshes of the metadata, as do some RPs, can someone explain the risk,...
4
votes
1answer
614 views

How does the “Service Identity” feature of Azure ACS compare (and contrast) to a real IDP?

It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing? Some examples I'm thinking of ...
5
votes
2answers
2k views

How do Azure ACS 2.0 security features compare to ADFS 2.0?

I'm configuring my relying party (a website) to use either ADFS or Azure ACS 2.0. ADFS 2.0 has some interesting features such as Token Replay prevention (in the SQL version) and may have other SAML ...