How to Utilize a Single Relying Party Trust for Multiple Web Applications that Share the Same Identifier

-
A common request we receive from customers is:

"I have multiple environments for the same web application. For example, development (DEV), staging (STAGE), and production (PROD). I want to create one Relying Party (RP) Trust in AD FS 2.0 which utilizes a single set of issuance claim rules, and I want AD FS 2.0 to send the user to the correct web application once they have authenticated."



The out-of-the-box, AD FS 2.0 capabilities answer: For WS-Federation passive RPs, this is not possible in AD FS 2.0 since we are bound to a single endpoint URL per protocol binding. For example, the WS-Federation POST binding can hold only a single value for endpoint URL. Although AD FS 2.0 allows for multiple identifiers (URIs) per RP Trust, there is no way within AD FS 2.0 to map each identifier to a unique WS-Federation endpoint URL.



For SAML 2.0 protocol RPs, we can handle this out of the box in AD FS 2.0. Please see the More Information section for more detail.



The you-are-on-your-own, custom solution answer: For WS-Federation passive RPs, it is possible to develop a page to sit in between your AD FS 2.0 RP-STS and your application environments. This page will be accessed by users instead of having users browse directly to the various web applications. There are several ways you could develop this page depending on the user experience you desire.



Below, you will find a sample ASPX page which accepts a query string parameter named ENV. The valid values for ENV are: test and stage. If this page is accessed without specifying the ENV query string parameter or a ENV value that is not valid, the user will be placed in the production environment.





NOTE: This code is provided "AS IS" with no warranties, and confers no rights.

For more information please visit http://www.microsoft.com/info/cpyright.mspx  to find terms of use.





Steps:



1. Copy the following code into a text file and save as default.aspx:

<%@ Page Language="VB" %>
<html dir="ltr"><head><title>SSO Redirect</title>
<%
Dim Env, Endpoint
Env=Request.QueryString("Env")
If Request.HTTPMethod="GET" Then
    If Env="test" Then
        Endpoint="https://your-test-endpoint/  "
    ElseIf Env="stage" Then
        Endpoint="https://your-stage-endpoint/  "
    Else
       Endpoint="https://your-production-endpoint/  "
    End If
    Response.Cookies("Endpoint").value = Endpoint
ElseIf Request.HTTPMethod="POST" Then
    If Not Request.Cookies("Endpoint").value Is Nothing Then
        Endpoint = Request.Cookies("Endpoint").value

        Response.ClearContent()

        Response.StatusCode = 307

        Response.StatusDescription = "Temporary Redirect"

        Response.RedirectLocation = ResolveClientUrl(Endpoint)

        Response.Flush()
    End If
Else
Response.Write("The requested HTTP method (" & Request.HTTPMethod & ") is not supported by this redirector page. This page supports HTTP GET and POST. Please contact your administrator.")


End If
%>






2. Copy the following code into a text file and save as web.config:



    

     

         

         

      

   





3. Set up a web site to host the default.aspx and web.config files from step 1. This site must have a valid SSL binding.





4. Create a RP Trust in AD FS 2.0 with at least a SAML 2.0 POST endpoint URL. If your RP applications utilize WS-Federation, create both SAML 2.0 POST and WS-Federation POST bindings with the same endpoint URL for both. The endpoint URL(s) must point to our custom page site.





5. Create a set of RP Trust claim rules that you wish to have apply to all of your RP web applications.





6. Ensure that all of your RP web applications accept a single identifier (audience URI) from AD FS 2.0





7. Modify the default.aspx of our custom site and replace the highlighted portions from above with values appropriate for your environment.





8. Test by browsing to the custom page. Examples of options:

        a. https://your-custom-site/  (result is PRODUCTION)

        b. https://your-custom-site/?env=test  (result is TEST)

        c. https://your-custom-site/?env=stage  (result is STAGE)





Explanation of flow:



    In this example, we will use ENV=test.



1. User browses to https://your-custom-site/?env=test 



2. ENV=test is evaluated to Endpoint=https://your-test-endpoint/



3. A session cookie named Endpoint is written to the client with a value of: https://your-test-endpoint/ 



4. The client is redirected to the IDP-initiated sign-on page of the AD FS 2.0 RP-STS with the query string parameter LoginToRP=your-RP-identifier



5. The user provides credentials to AD FS 2.0



6. The RP Trust policy is processed



7. A SAML assertion is posted from AD FS 2.0 to our custom page site



8. Along with the POST, the client presents the Endpoint cookie back to our custom page



9. Our custom page redirects (HTTP 307) the POST data to the URL specified in the Endpoint cookie



10. The end application consumes the token POST and access is granted to the site

Comments

Post a Comment

Popular posts from this blog

altiris software key

-
Image
I think a lot of people, like me, spend a lot of time try finding how to get those download: Latest Symantec workspace Virtualization , SWV 6.1, that is advanced SVS version, is integrated with the Altiris client management suite CMS 7.  (Yes, it was also named "SVS PRO") Notice 1: This package includes the "Wise Virtual Composer", and both x86+x64 versions. Notice 2: This link currently also includes SWS (Streaming) and SWC (Corporate) [please vote my post if you use it ;-] Story : I was thinking only SVS 2.1 (Software Virtualization Solution) was integrated into the "Client Management Suite 7". But this is not the case and SWV 6.1 (Symantec Workspace Virtualization) must not be paid in addition . Free home license : Both SVS 2.1 "light" version & SWV are still free personal use. I suggest you use now the latest SWV 6.4 (That is SWV 6.1 SP7 or following! Yes Symantec do this version naming - vote here also to a...
Read more

Service Principal Names (SPNs) SetSPN Syntax (Setspn.exe)

-
Image
Service Principal Names (SPNs) SetSPN Syntax (Setspn.exe) Table of Contents SPN Purpose SPN Format SetSPN Viewing or Checking SPN Registrations SPN Registration Errors Related to SPN Registration or Configuration Manually Registering SPNs Troubleshooting SPN Issues Resolving SPN Registration Issues SPN Lookup Errors Delegation External Articles SPN Purpose A service principal name (SPN) is the name by which a Kerberos client uniquely identifies an instance of a service for a given Kerberos target computer. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host. ↑  Return to T...
Read more

Troubleshooting Netlogon Error Codes

-
Image
Quick Reference: Troubleshooting Netlogon Error Codes ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ January 28, 2013   by  Mark Morowczynski [MSFT]   //   24 Comments 0 0 Hi this is Brandon Wilson and today I will be providing you with a quick reference for troubleshooting Netlogon error codes. I say “quick reference” very loosely here, because this is one of those sticky subjects that can easily expand into many more areas and become a very long discussion. So, I’m going to do my best to focus on just the codes and possible solutions for the error codes that are more common to see. Anyone who has dealt with some of these issues knows that some of these outlined areas can lead to huge revenue loss for a business, or at the very least an annoying authentication prompt J I welcome you to leave comments and questions, or suggestions for articles that you as the reader would be interested in seeing us do on AskPFE Platforms ( http://blogs.tech...
Read more