<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
h1
{mso-style-priority:9;
mso-style-link:"Heading 1 Char";
margin-top:12.0pt;
margin-right:0in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
page-break-after:avoid;
font-size:16.0pt;
font-family:"Calibri Light",sans-serif;
color:#2F5496;
font-weight:normal;}
h2
{mso-style-priority:9;
mso-style-link:"Heading 2 Char";
margin-top:2.0pt;
margin-right:0in;
margin-bottom:0in;
margin-left:0in;
margin-bottom:.0001pt;
page-break-after:avoid;
font-size:13.0pt;
font-family:"Calibri Light",sans-serif;
color:#2F5496;
font-weight:normal;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.Heading1Char
{mso-style-name:"Heading 1 Char";
mso-style-priority:9;
mso-style-link:"Heading 1";
font-family:"Calibri Light",sans-serif;
color:#2F5496;}
span.Heading2Char
{mso-style-name:"Heading 2 Char";
mso-style-priority:9;
mso-style-link:"Heading 2";
font-family:"Calibri Light",sans-serif;
color:#2F5496;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi All,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I have a legacy ADFSv3 server which proxies Office365. After switching over to my new IDP (v3.4.4) I find I am having an issue with application based authentication. I seems that when I login to the web
interface the AuthnRequest look like this<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><?xml version="1.0" encoding="UTF-8"?><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><samlp:AuthnRequest<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> Destination="https://idp.fdu.edu/idp/profile/SAML2/Redirect/SSO"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> ID="id-2333c098-3bce-42fe-9a31-1bcddb688e92"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> IssueInstant="2019-08-16T10:05:32.091Z" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://sso.fdu.edu/adfs/services/trust</Issuer><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"></samlp:AuthnRequest><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">However, when Word, Excel, Teams, etc.. try to log in it looks like this<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><samlp:AuthnRequest<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> Destination="https://idp.fdu.edu/idp/profile/SAML2/Redirect/SSO"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> ForceAuthn="true" ID="id-4f135dfe-dfbd-4bb4-8a22-78cfac58b6a9"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> IssueInstant="2019-08-16T08:21:25.632Z" Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://sso.fdu.edu/adfs/services/trust</Issuer><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <samlp:RequestedAuthnContext><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <samlp:AuthnContextClassRef xmlns:samlp="urn:oasis:names:tc:SAML:2.0:assertion">http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</samlp:AuthnContextClassRef><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </samlp:RequestedAuthnContext><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"></samlp:AuthnRequest><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Which causes my IDP to - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:408] - Profile Action SelectAuthenticationFlow: Forced authentication requested, selecting an inactive flow<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I have read a few posts and looked at the v2
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/MicrosoftInterop">MicrosoftInterop</a> docs where the solution was to create a handler just for ADFS. On person posted changing the Password handler like this as to add the context but Scott noted
“</span><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black;background:white">that would make it the *only* method”.
</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> p:passiveAuthenticationSupported="true"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> p:forcedAuthenticationSupported="true" ><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <property name="supportedPrincipals"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <bean parent="shibboleth.SAML2AuthnContextClassRef"<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> c:classRef="http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </property><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </bean><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black;background:white">In a similar post where the poster was dealing with MFA the poster referenced the v2 MicrosoftInterop doc and not wanting to create a sperate handler.
In that thread Scott posted<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black;background:white"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black;background:white">I haven't done that, and I haven't supported any of their made up attributes. It's been pretty much vanilla integrations
for me on campus. I also have a variety of vendors using ADFS and none of them have ever issued requests with a non-standard context class. </span><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black"><br>
<br>
<span style="background:white">Basically, you can treat ADFS like any other SP for the most part. </span><br>
<span style="background:white"> </span></span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">So my question is this: in the
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationFlowSelection">
AuthenticationFlowSelection</a> doc it mentions in the Comparison Configuration section that I can ignore context. Is the best method to deal with this to. create a ignore rule like below and does it work like I think it does and turns my application based
AuthnRequest into regular authn/Password requests?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <util:list id="shibboleth.IgnoredContexts"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <value>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <value></span><span style="font-size:11.0pt"> http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</span><span style="font-size:11.0pt"> </value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </util:list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">What are other institutions doing?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">-Chris<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>