Repeated Login with Shib (idp) and ADFS (sp)

[Thomas Jones]

I found what the problem was! (But I'm figuring out some pending aspects)

The problem is that once Shib's Idp answers back with a SAML Response
(containing the assertion that states that the user was successfully
authenticated) to the ADFS, the ADFS then resolves a WS-Federation URL
where it sends the end-user; the issue is that this URL (once it's been
resolved by the ADFS) always sends a SAML AuthnRequest with the attribute
ForceAuthn = true, that's why I see a double login before getting into the
Relying Party app. (Because Shib's Idp is acting accordinly to what the
Relying Party is sending to it).

We have told the people of the ADFS that they need to remove the policy
that forces the authentication in this WS-Federation URL (is this the best
answer we can give them?), but I would like to ask you:

1. Do you know if there's something that can be done on Shib's Idp side
when it receives this SAML AuthnRequest (that has the ForceAuthn = true)
and get from a session or a cookie info that can used to create a SAML
Response that doesn't require to force the user to a whole authentication
process (somehow a silent authentication)?

2. Do you know or anyone where in the ADFS I can turn off the policy of
ForceAuthn = true for this WS-Federation URL?, is in the ADFS Management
tool? or is in the Relying Party App modifying the code in the .net app
(perhaps in the web.config file)?

Thanks for all the help

Best,


On Thu, Jan 22, 2015 at 10:41 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 1/22/15, 3:39 PM, "Thomas Jones" <thomas.jones.g at gmail.com> wrote:
>
>
> >
> >So I'm guessing I'm not using their correct AssertionConsumerService
> >(either POST or redirect) but instead I'm using an endpoint that only
> >understand WS-Federation, right?
>
> Seems possible.
>
> >Another question: Why after the Ws-Federation URL is resolved and the
> >end-user reauthenticates, the process is correctly done, I mean the
> >AssertionConsumerService is displayed in the URL address bar and the
> >end-user is send to the Sp's app?
>
> No idea.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150123/a2f7f93f/attachment.html