Clarification on how to use DirectFedAuthUrl TXT record for B2B External Identity to a SAML IDP with a different passiveSignInUri

Question

I am trying to implement the DirectFedAuthUrl process to point a subdomain to a SAML IDP. I am referencing this document: https://learn.microsoft.com/en-us/azure/active-directory/external-identities/direct-federation.

I created the records in the subdomain fed.mydomain.com. The txt records show up in dig.
"DirectFedAuthUrl=https://auth.anotherdomain.com/realms/keycloak"

when I setup fed.mydomain.com as an additional domain in the SAML provider as an external Identity in an External Identity Provider, I get the error:

Failed to add fed.mydomain.com. Invalid passiveSignInUri fed.mydomain.com. The passiveSignInUri should match the domain. Otherwise, please add the passiveSignInUri in the domain DNS TXT record like this DirectFedAuthUrl=fed.mydomain.com

when i do a DIG from google toolbox i get the below:

TTL:

1 hour

VALUE:

"DirectFedAuthUrl=https://auth.anotherdomain.com/realms/keycloak"

It seems odd to me to add a txt record of DirectFedAuthUrl=fed.mydomain.com to the domain fed.mydomain.com when the IDP is at https://auth.anotherdomain.com/realms/keycloak

Answer 1

@Christopher Butler

Thank you for posting YOUR QUERY ON Microsoft Q&A. Based upon your description above it seems like you are not able to add SAML IDP with a passive authentication endpoint.

On digging further I saw there has been a similar known issue which is worked by dev team.

As a work around could you please try the following action:

• To update the DNS TXT record, please try using 'DirectFedPassiveSignInUri' instead of 'DirectFedAuthUrl' as below

 

Instead of using:

fabrikam.com.  IN   TXT   DirectFedAuthUrl=https://fabrikamconglomerate.com/adfs

Try using:

fabrikam.com. IN  TXT  DirectFedPassiveSignInUri=https://fabrikamconglomerate.com/adfs

 

Please do let me know in comments if this does not help so that we could move to next plan of action.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.