Microsoft Edge SSO with AD FS

Stan_S 1 Reputation point
2020-06-19T03:12:38.577+00:00

Hi,

I have Edge build 83.x. I have AD FS 4.0 on 2019. I have the applicable WIA Agent in AD FS. I have the applicable URL in 'Local Intranet Zone' configured in IE. I also use the whitelist switch when starting Edge.

However, when browsing to /adfs/ls/idpinitiatedsignon, I get prompted with an NTLM Windows Security box for a username and password. If I disable WIA in AD FS, I stop at the Form Authentication, so I know AD FS is (at least I think it is) detecting the User Agent String correctly.

Am I missing something?

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,200 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Christoph Thurnheer 81 Reputation points
    2020-06-22T13:28:47.62+00:00

    You have to set ADFS properties to support Edge Chromium. 

    Set-AdfsProperties -WIASupportedUserAgents @("MSIE 6.0", "MSIE 7.0; Windows NT", "MSIE 8.0", "MSIE 9.0", "MSIE 10.0; Windows NT 6", "Windows NT 6.3; Trident/7.0", "Windows NT 6.3; Win64; x64; Trident/7.0", "Windows NT 6.3; WOW64; Trident/7.0", "Windows NT 6.2; Trident/7.0", "Windows NT 6.2; Win64; x64; Trident/7.0", "Windows NT 6.2; WOW64; Trident/7.0", "Windows NT 6.1; Trident/7.0", "Windows NT 6.1; Win64; x64; Trident/7.0", "Windows NT 6.1; WOW64; Trident/7.0", "MSIPC", "Windows Rights Management Client", "Edg/*")

    Last property "Edg/*" should do the trick. Ref: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-browser-wia

    1 person found this answer helpful.
    0 comments
  2. Edwin C 1 Reputation point
    2021-01-25T14:34:56.003+00:00

    Current settings for ADFS server 2016 and higher, according to the microsoft link should be:

    Set-AdfsProperties -WIASupportedUserAgents @("MSIE 6.0", "MSIE 7.0; Windows NT", "MSIE 8.0", "MSIE 9.0", "MSIE 10.0; Windows NT 6", "Windows NT 6.3; Trident/7.0", "Windows NT 6.3; Win64; x64; Trident/7.0", "Windows NT 6.3; WOW64; Trident/7.0", "Windows NT 6.2; Trident/7.0", "Windows NT 6.2; Win64; x64; Trident/7.0", "Windows NT 6.2; WOW64; Trident/7.0", "Windows NT 6.1; Trident/7.0", "Windows NT 6.1; Win64; x64; Trident/7.0", "Windows NT 6.1; WOW64; Trident/7.0","Windows NT 10.0; WOW64; Trident/7.0", "MSIPC", "Windows Rights Management Client", "=~Windows\s*NT.Edg.")

    0 comments