Login into an aad-joined windows 10 computer with SAML 2.0 federated domain

Question

Hello,

I have an Azure Active Directory Tenant, on which the domain is federated through SAML 2.0. I would like to use this directory to manage windows 10 computers, but when I link the domain to the computer, i cannot login into the computer as it asks for a password which there isn't since the user is logged in through saml.

Is it possible to login into windows using the SAML 2.0 federated domain ?

Answer 1

It seems that i've not been correctly explaining.

I have successfully joined the computer to the AAD tenant and while using SAML 2.0, but when i want to log in into windows, it asks for username/password, which obviously cannot work as the account uses the SAML 2.0 serveur to authenticate. I have successfully federated the domain, this is not the issue, the issue is that, after joining the computer to the tenant, i cannot login using aad's accounts, the only account that works is the local computer administrator.

I'm not sure if i've been clear, so i'll clear it up, here Azure Active Directory is a Service Provider, the SAML Identity Provider is a standalone, custom SAML 2.0 php implementation. Therefore when logging in, AAD redirects the user (through HTTP) to the IDP for identification.

Answer 2

@GribouilleVert The machine needs to be Azure AD join or Hybrid Join State in order to login to Windows 10 machine using federated state.
If you are using ADFS as federation server.

Windows 10 login need WS-trust username/mixed endpoints to be enabled in ADFS, please check if you have them enabled, If not, please enable them on endpoints and try again. Can you get the list of all ADFS endpoints and share what are the current configurations ? Thanks.

Answer 3

@VipulSparsh-MSFT I do not use a local Active Directory server, my federation is a custom implementation of the SAML 2.0 protocol. It is available at gateway.vasco.network (https://gateway.vasco.network/saml/metadata.xml).

The only config i can provide you is the SAML server one (which i doubt will be of any use).

Answer 4

Hi there,

Yes, you can log in to windows using the SAML 2.0 federated domain . The Microsoft identity platform uses the SAML 2.0 protocol to enable applications to provide a single sign-on experience to their users.

Use a SAML 2.0 Identity Provider (IdP) for Single Sign-On
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp

Federation with SAML/WS-Fed identity providers for guest users
https://learn.microsoft.com/en-us/azure/active-directory/external-identities/direct-federation

---------------------------------------------------------------------------------------------------------------------

If the reply is helpful, please Upvote and Accept it as an answer

Answer 5

Ow ! Ok, well thank you very much !