ADFS : SSO with Windows session

Question

ADFS : SSO with Windows session

FXE 516

Hi all,

I'm searching for a solution to connect an external application capturing Windows session.
We have an ADFS 2019.

Today, we are able to connect to this application but we have to login to ADFS before access it, and I want to bypass this step if possible.
Application access will only be from internal network.

Thank you !
Regards,

6 answers

Your answer

Answer 1

Pierre Audonnet - MSFT 10,191 Microsoft Employee

SSO configuration are described here: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-intranet-forms-based-authentication-for-devices-that-do-not-support-wia#configuring-wia-for-chrome

In a nutshell, you need to make sure that:

Your browser is configured to accept Windows Integrated Authentication for the ADFS URL (that might mean that you need to add the URL to some trusted zone security settings) - that's not specific to ADFS by the way, that's for all website on which you want to us WIA.
Your ADFS is configured to accept your browser for SSO (that's the link I copied earlier). That's with the WIASupportedUserAgents parameter.
Your authentication policy is allowing WIA (and the application not forcing Form Based Authentication).

FXE 516 Reputation points

2021-05-17T19:53:10.91+00:00
Hi piaudonn and thank you for answer.

Here is what I currently see in our ADFS configuration :

Get-AdfsProperties | select -ExpandProperty WiaSupportedUserAgents MSAuthHost/1.0/In-Domain MSIE 6.0 MSIE 7.0 MSIE 8.0 MSIE 9.0 MSIE 10.0 Trident/7.0 MSIPC Windows Rights Management Client MS_WorkFoldersClient =~Windows\s*NT.*Edge

The browser we use is MS Edge Chromium.
In your mind, should I add "Mozilla/5.0 (Windows NT)" whereas there is already "=~Windows\s*NT.*Edge" ? Perhaps it's for Edge legacy ?

Thank you.

Answer 2

FXE 516

@Pierre Audonnet - MSFT : I found a post from you about that here : https://learn.microsoft.com/en-us/answers/questions/100097/sso-support-for-edge-chromium-based-with-adfs-30.html

Following that, now I have this ADFS configuration :

Get-AdfsProperties | select -ExpandProperty WiaSupportedUserAgents  
MSAuthHost/1.0/In-Domain  
MSIE 6.0  
MSIE 7.0  
MSIE 8.0  
MSIE 9.0  
MSIE 10.0  
Trident/7.0  
MSIPC  
Windows Rights Management Client  
MS_WorkFoldersClient  
=~Windows\s*NT.*Edg.*

From that, I'm not landing on ADFS login page anymore, and Edge prompts for credentials. I guess to be on the good way.
But SSO still doesn't work.

Any idea please ?
Thank you.

Regards,

Pierre Audonnet - MSFT 10,191 Reputation points Microsoft Employee

2021-05-17T20:57:04.093+00:00

Your browser needs to be configured to accept Windows Integrated Authentication for the ADFS URL (that might mean that you need to add the URL to some trusted zone security settings) - that's not specific to ADFS by the way, that's for all website on which you want to us WIA.

Open the internet option and add the ADFS URL to the list of trusted sites.

Answer 3

FXE 516

Sorry I missed to say you I have already added our ADFS URL in Intranet zone.

Regards,

Answer 4

FXE 516

Hmm... I've just tested to copy ADSF generated URL to IE, and it seems to work without credentials prompt.

Probably due to MS Edge / ADFS misconfiguration ?

I found various syntaxes for ADFS to work with MS Edge : "=~Windows\s*NT.Edg.", "=~Windows\sNT./Edg, "=~Windows\sNT.*Edg", ...

Is there a real good syntax ?

Answer 5

FXE 516

You talk about a trace from events logs / ADFS Tracing ?

Pierre Audonnet - MSFT 10,191 Reputation points Microsoft Employee

2021-05-18T20:53:38.993+00:00

A client trace that will show everything. The user agent yuo send and the response from the ADFS server. You can use fiddler for example (do not install Fiddler on the ADFS server though, install it on the client where you do the trace and enable HTTPs decyrption in the options, else we won't see anything in the trace). You can also use the Developper mode of Edge or Chrome as they have an option to record the session too.

Share via

ADFS : SSO with Windows session

6 answers

Your answer