<div dir="ltr">I found what the problem was! (But I'm figuring out some pending aspects)<div><br></div><div>The problem is that once Shib's Idp answers back with a SAML Response (containing the assertion that states that the user was successfully authenticated) to the ADFS, the ADFS then resolves a WS-Federation URL where it sends the end-user; the issue is that this URL (once it's been resolved by the ADFS) always sends a SAML AuthnRequest with the attribute ForceAuthn = true, that's why I see a double login before getting into the Relying Party app. (Because Shib's Idp is acting accordinly to what the Relying Party is sending to it).</div><div><br></div><div>We have told the people of the ADFS that they need to remove the policy that forces the authentication in this WS-Federation URL (is this the best answer we can give them?), but I would like to ask you:</div><div><br></div><div>1. Do you know if there's something that can be done on Shib's Idp side when it receives this SAML AuthnRequest (that has the ForceAuthn = true) and get from a session or a cookie info that can used to create a SAML Response that doesn't require to force the user to a whole authentication process (somehow a silent authentication)?</div><div><br></div><div>2. Do you know or anyone where in the ADFS I can turn off the policy of ForceAuthn = true for this WS-Federation URL?, is in the ADFS Management tool? or is in the Relying Party App modifying the code in the .net app (perhaps in the web.config file)?</div><div><br></div><div>Thanks for all the help</div><div><br></div><div>Best,</div><div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 22, 2015 at 10:41 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 1/22/15, 3:39 PM, "Thomas Jones" <<a href="mailto:thomas.jones.g@gmail.com">thomas.jones.g@gmail.com</a>> wrote:<br>
<br>
<br>
><br>
>So I'm guessing I'm not using their correct AssertionConsumerService<br>
>(either POST or redirect) but instead I'm using an endpoint that only<br>
>understand WS-Federation, right?<br>
<br>
</span>Seems possible.<br>
<span class=""><br>
>Another question: Why after the Ws-Federation URL is resolved and the<br>
>end-user reauthenticates, the process is correctly done, I mean the<br>
>AssertionConsumerService is displayed in the URL address bar and the<br>
>end-user is send to the Sp's app?<br>
<br>
</span>No idea.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div>