Repeated Login with Shib (idp) and ADFS (sp)

[Thomas Jones]

Hi,

I've configured Shib as the Idp and an ADFS 3.0 as the Sp.

The integration uses the IdPAuthExternal mechanism in order to provide a
second factor of authentication. This is how the flows happens:

1. User goes to the ADFS app where all Claim Providers are listed.
2. The user selects Shib's Idp
3. The user is redirected to an external app where his credentials and
second factor are validated.
4. Once the external auth is completed, the app sends the respond to Shib
and then it's send to the ADFS, but the ADFS some how (I don't know why) it
sends back the users to step 3, where the user needs to start the whole
authentication process all over again. Once that it's ready and Shib sends
the respond to the ADFS (for the second time) NOW the user can access the
SP application configured in the ADFS.

I've seen that when my external app sends the respond to Shib's Idp and
this sends the respond to the ADFS, this one tries to access the next URL
(but later on it sends the user back to my external app, to repeat the
authentication process, as I have just mentioned):

https://adfs-domain/adfs/ls/?wa=wsignin1.0&wtrealm=https%3a%2f%2appcomain.com%2fapp.internet%2f&wfresh=5&wctx=rm%3d0%26id%3dpassive%26ru%3d%252fapp.internet%252fHome%252fStart&wct=2015-01-22T00%3a15%3a24Z

But after the user has repeated for the second time the authentication, the
previous URL is not showed at all. Is this a miss configuration from the
ADFS or Shib?

I don't know if this has to do with my configuration with my ExternalAuth
handler, next you can see my configuration:

    <ph:LoginHandler xsi:type="ph:ExternalAuthn"
                      externalAuthnPath="ext/login"
                      supportsForcedAuthentication="true"
                      supportsPassiveAuthentication="false">

<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
    </ph:LoginHandler>


Any help is much appreciated!

Best,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150122/81ec215f/attachment.html