ADFS basic authentication

testuser7 271 Reputation points
2021-10-06T13:32:14.753+00:00

Hello,

When my web application is sending the browser to ADFS for authentication, ADFS is challenging the user with "BASIC Authentication"
As a result, browser is asking user to provide username and password.

My problem is, if I am using Firefox I get the standard HTML basic-auth popup as attached in the screen-shot.
However, if I am using Edge then I am seeing the native "windows security" popup as attached in the screen-shot.
My understanding is that this is the default interpretation of Edge browser to resolve basic-authentication.
I do not want edge to behave this way.

Is it possible to configure edge to take the standard html popup route ??

138186-image.png

138214-image.png

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,190 questions
0 comments

12 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee
    2021-10-13T01:27:37.337+00:00

    Both of these pop-ups are "Windows Security Challenges" like you call them. Your browser is behaving as expected. It translates the WWW-Authenticate: Negotiate header into a pop-up. It does not mean you credentials will be sent in clear text, you will end up doing Kerberos or NTLM authentication (no basic as there are no handler for that).

    I don't understand your position. What are you trying to do? What is the expected result? What is a big issue and why?

    1. Do you want SSO to work? Meaning do you want to be seamlessly connected without having to type anything? If so, back to my first comment: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-iwa
    2. Do you want Form Based Authentication (being prompted for username and password in HTML - this is NOT called a pop-up)? If so for all browsers? For all apps?
    0 comments
  2. testuser7 271 Reputation points
    2021-10-25T12:44:39.203+00:00

    Hi @Pierre Audonnet - MSFT

    As you stayed with me for long time to help me clarify this topic, I think it is my duty now to update that I found the solution.
    It was actually simple.

    There is a registry setting in Edge

    Under HKLM\SOFTWARE\Policies\Microsoft\Edge, please create one D-Word with WindowsHelloForHTTPAuthEnabled = 0

    That's it. This will completely turn off the "windows security prompt" and you will get the pure HTML prompt to put credentials.

    Thanks.

    0 comments