Questions tagged [adfs]
Active Directory Federation Services (ADFS) is an identity access solution developed by Microsoft.
33
questions
1
vote
1
answer
48
views
Verify user credentials via SAML (E-Signature)
I have a requirement to extend a quality assurance process in the customers CRM system so that when the user enters some data he or she is prompted to a screen with username and password and the ...
- 11
0
votes
0
answers
212
views
Secure ADFS behind HAProxy
We use ADFS within our organisation, and it is available via HTTP externally.
All of the applications we protect with ADFS are SP-initiated, so I want to disallow requests to ADFS other than SP-...
- 105
1
vote
0
answers
51
views
in Saml Federation, can one Idp serve as a facade for authentication against multiple "back end" IdP's
Question
In Saml Federation, can one Idp serve as a front-end proxy for authentication against multiple "back end" IdP's
Context
our multi-tenant application suports SAML for Authentation ...
- 111
0
votes
1
answer
236
views
CSRF in ADFS environment?
Is traditional CSRF PoC (e.g. described here) effective for testing in this environment
Specifically if PoC only involved one account - of course, given presence of ADFS SSO...so not counting the ...
1
vote
0
answers
508
views
Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?
I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
- 11
0
votes
1
answer
364
views
What a malicious user could do with a refresh token that cannot be revoked and has 1 year expiry time?
In ADFS 4.0 a refresh token cannot be renowed without passing through an authorization request flow (asking the user again for credentials) and cannot be revoked.
I'm forced to put a 1 year lifetime ...
- 1,507
1
vote
1
answer
331
views
How to protect a login page redirect
I have several web based applications that will redirect unauthenticated users to an ADFS sign-in page. ADFS will subsequently redirect users back to a web application once authenticated with a token.
...
- 153
2
votes
2
answers
400
views
Solutions for accessing webapp from inside and outside the corporate perimeter by same users?
I'm looking for solutions that could best address the following requirements.
We plan to develop a webapp and deploy it in the cloud.
Corporate users must be able to access the webapp from the ...
- 21
0
votes
1
answer
224
views
What do I need to ask 3rd party to add trust
We have ADFS and want to add a 3rd party application as trusted to it. I have certificate and metadata (xml) URI to give them but want to have a checklist what they need to give me. So far
HTTP ...
- 15
-1
votes
1
answer
2k
views
windows authentication vs ADFS
I have an ASP.NET website hosted on premises and only accessible by my company. I discovered that if I connect it to a server in the DMZ (open to the internet) even though the IIS folder is set to ...
- 65
2
votes
1
answer
437
views
Adfs saml credential provider
Wanted to see if the following is feasible or is there a way out?
My situation, computers have internet access always (assumption)
I want to write a credential provider with a browser embed and talk ...
- 101
0
votes
1
answer
1k
views
ADFS Self-signed Certificate
I can't find an answer to this, so I'm hoping you good people will know. I'm about to install ADFS into Production including a Web Application Proxy in the DMZ. When WAP is joined to a farm or a ...
- 3
3
votes
1
answer
1k
views
How to properly handle security certificates in asp.net (ws-federation)
So I'm setting up single-signon authentication for the organization I work for.
Our IT guy has setup an ADFS server, which is where we're getting our logon credentials from. He's using an in-house ...
- 231
2
votes
1
answer
318
views
ADFS claims consolidation from different issuers
I hope I understand the claims concept in general now after reading related articles on ADFS, certificates used for claims token signing etc. But here is what strange for me:
Claims are so abstract ...
- 153
1
vote
1
answer
592
views
ADFS with multiple IDP stops doing the SSO [closed]
I'm facing an issue when we enable a second IDP (add Claims Provider Trust), then we are not able to navigate between apps without stopping in the HRD (Home Realm Discovery) page.
Is there a way to ...
- 111
2
votes
0
answers
367
views
Authenticate with ADFS without Javascript?
I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS.
Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
- 121
2
votes
0
answers
730
views
Check if user is logged in on other ADFS authenticated site
I've been looking around for this specific situation, but so far no good..
We have multiple websites that use ADFS WSFederation, and we would like for a user to always pass through one, before being ...
- 141
3
votes
1
answer
1k
views
ADFS 3.0 OAuth2.0 against client applications
ADFS 3.0 does not support the Implicit Grant client flow of Oauth2, nor does it support client secrets.
Initial investigations suggest it is not secure to use the Authorize Code Grant flow from a ...
- 131
1
vote
1
answer
4k
views
Best way to deal with cross-domain authentication in intranet
Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow?
Overview on use-case, what we trying to achieve:
Two servers, on two different domains; ...
- 121
2
votes
0
answers
572
views
Mitigating the risk of disabling EPA on ADFS
I'm currently investigating the deployment of an Active Directory Federation Services (ADFS) server for providing Single Sign-on for various services. By default, ADFS enables support for Extended ...
- 21
2
votes
1
answer
2k
views
Is an ADFS "proxy" required in a production, Internet-facing ADFS deployment?
Is it acceptable to simply deploy ADFS, and expose 80/443 to the Internet, opposed to deploying redundant Front End and Back End servers?
I understand that I'm missing out on Token Replay Attack ...
- 50.7k
5
votes
1
answer
2k
views
SAML Assertion to Windows Identity (Kerberos token?) transformation
This is the scenario I need to cover:
A WebService that trusts on an IdP using Ws-Trust or any thing like that, receives a SAML token to authenticate the user, and we need to call some SQL Server or ...
- 51
5
votes
3
answers
11k
views
ADFS 2012 R2 (3.0) JSON web token validation
Our client would like for us to utilize ADFS 2012 R2 (aka 3.0) as the primary means for two security features in internal apps that we are building:
The web app (there are two .NET & Angular) and ...
- 51
1
vote
0
answers
760
views
Using a bearer token to get a federation token from ADFS
Why is it not possible to use a bearer token from an IdP STS to get ADFS (2.1) to issue a token? All issuedtoken endpoints require a symmetric or asymmetric key in the IdP token.
Is there a specific ...
- 169
0
votes
2
answers
7k
views
Authenticate WCF call to ADFS through Web Application Proxy (WAP)
Currently we authenticate WCF calls TO a service via ADFS, using the following procedure:
Firstly, we get a SAML token from ADFS
using (var factory = new WSTrustChannelFactory(
new ...
- 5,443
8
votes
1
answer
6k
views
ADFS: Verify requests from relying party
In ADFS, serveral certificates are used. This is explained (very clearly) on this page: http://blogs.technet.com/b/adfs/archive/2007/07/23/adfs-certificates-ssl-token-signing-and-client-authentication-...
- 5,443
1
vote
0
answers
157
views
Is it safe to store password in a session context? ADFS
I'm playing with adfs, and I'd like to store credentials in a session context during my questioning of the user. So, my question is, is it safe to store sensitive data in a session context?
Thanks
- 11
10
votes
3
answers
45k
views
How to achieve seamless SSO without having the user to login again (SAML 2.0 & ADFS using OpenSSO)
We need to implement seamless SSO with ADFS SAML 2.0 using OpenSSO & we plan to go with IdP initiated GET binding. The user in client network will log in to ADFS with Windows credentials once ...
- 163
8
votes
1
answer
5k
views
What are the security concerns with turning off Extended protection for authentication in IIS7 on ADFS?
In setting up SSO for Office 365, in order to make Chrome and Firefox access services on the Intranet, Extended Protection for Authentication must be disabled on the ADFS sever.
As the ADFS server is ...
- 181
15
votes
4
answers
7k
views
How do the STS token formats compare to each other SAML vs SWT vs JWT?
I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
- 50.7k
1
vote
1
answer
857
views
What risk can untrusted WS-Federation metadata pose?
I'm adding support for SAML/ADFS/Azure ACS and read that untrusted metadata poses a risk.
Considering that ADFS does background refreshes of the metadata, as do some RPs, can someone explain the risk,...
- 50.7k
4
votes
1
answer
658
views
How does the "Service Identity" feature of Azure ACS compare (and contrast) to a real IDP?
It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing?
Some examples I'm thinking of ...
- 50.7k
5
votes
2
answers
2k
views
How do Azure ACS 2.0 security features compare to ADFS 2.0?
I'm configuring my relying party (a website) to use either ADFS or Azure ACS 2.0.
ADFS 2.0 has some interesting features such as Token Replay prevention (in the SQL version) and may have other SAML ...
- 50.7k