How to bypass SSO screen when using SAML 2.0 via ADFS

efg20 1

Hello, we have a 3rd party application that uses SAML 2.0 for SSO, but it requires ADFS. We configured our first ADFS server using one of our 2012 R2 domain controllers. When we go to the 3rd party URL it displays the login screen below...

Is there a way to bypass this screen and have it automatically log the user in using the credentials of the windows session?

Thank you for your help.

2 answers

Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee

2020-08-11T20:42:18.673+00:00
It could be one (or a combination) of the followings:

The user is connecting through a Web Application Proxy (WAP), Form Based Authentication (FBA) is the default Primary Authentication for WAP.

The browser's user-agent is not listed as supported for the Windows Integrated Authentication (WIA) and ADFS make it fall back to FBA. You can find more details here.

The Relying Party (aka Service Provider in a SAML2 scenario) is configured to ask for the FBA. Application have the power to ask for the authentication method they want as long as ADFS supports them. If that's the case, you can see it in the URL the user was redirected to. You can share what the user has in the address bar when it sees the form. If that's the case, you will have to ask the application's owner to change this. Nothing you can do at the ADFS level then.
Please sign in to rate this answer.
efg20 1 Reputation point

2020-08-14T23:38:15.187+00:00

Thank you for your quick response. I followed the steps in the article you provided for reason #2. For reason #1, I assume the screenshots below is what you are referring to:

Unfortunately, I am still getting the ADFS SSO page prompting me for my AD credentials, I will reach out to the 3rd party application provider to see what they can do for me.

Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee

2020-08-15T01:31:18.807+00:00

What browser are you using? And what is the output of:

Get-AdfsProperties | select -ExpandProperty WiaSupportedUserAgents

Also, to confirm option 3 without having to ask the 3rd party, just copy/paste the URL the users have in their address bar when they see the form. It might be enough info.
Sign in to comment
efg20 1 Reputation point

2020-08-17T17:24:30.993+00:00

We use IE11 and google chrome.

Here is a screenshot of the powershell command results:

From within IE11, the URL that appears when the user sees the form is:

https://ADFS server FQDN/adfs/ls/?SAMLRequest=fZCxboMwEIZfhc0TGCgCagESapZI6ZK0HbpUZ%2BdIUI1Nfabi8QuJqqYdOp70%2Fd%2Fd%2FRXBoEfRTv5s9vgxIfmgJULne2serKFpQHdA99krfN7vanb2fiTBuban3kTzPFOk7MBhEfDVxRVoLUG9s2CzyHoDq%2BkntyQi604cjh1xTZwF203N3rq8lBncYZgnEsMMiyyE%2B1SGIFUmk04lKeYLSjTh1pAH42uWxmkcxmWYFE9JIZJUZOUrC17Q0WVjGsUsmAdtSKyH1WxyRlignoSBAUl4JQ7t404soIDvn28j4%2F%2BZ0VlvldWsqVZaXK5zzZ%2BGBjz207Wkit9y1%2Bl3980X
Please sign in to rate this answer.
Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee

2020-08-17T19:47:36.687+00:00

The SAMREQUEST is fine , it does not specify an authentication method.

IE11 might show up with Mozilla/5.0 user agent string. Run the following on your ADFS server:

Set-AdfsProperties -WIASupportedUserAgents ((Get-ADFSProperties | Select -ExpandProperty WIASupportedUserAgents) + "Mozilla/5.0"

And try again.

efg20 1 Reputation point

2020-08-18T19:38:59.977+00:00

OK, I added "Mozilla/5.0. I no longer get the SSO sign in page, but this windows security pop-up window comes up:

Entering my AD credentials into this prompt does not allow me to access the 3rd party site.

Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee

2020-08-19T13:38:39.737+00:00

This is an IE setting. The URL of your ADFS farm need to be either in the Trusted Site List or the Intranet Site List.
All is explained here.

kytay 6 Reputation points

2020-09-08T08:08:12.823+00:00

Hi

Like to double confirm if this solution works for Windows Server 2016 ADFS.

I have referred to many links for automatic windows integrated authentication but they don't seems to get it to work.
Example:
https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-browser-wia
https://hi.service-now.com/kb_view.do?sysparm_article=KB0759249

kytay 6 Reputation points

2020-09-08T08:08:33.277+00:00

So just like to clarify how the behavior should be?

When user access https://app.example.com/ (sP) with chrome, it will get redirected to https://adfs.example.com/adfs/ls/wia?SAMLRequest=xxxxx (idP)

What I will expect, I will not be presented with a ADFS login page (e.g https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/images/dn280950.dcf00a31-5a4c-4929-a5de-e170bfffb994(ws.11).jpeg ), and get "silently login" and be redirected back to https://app.example.com/ through POST binding.

What it turns out to be, i do not see the ADFS login page, but instead I will be seeing a popup chrome user credential prompt, e.g https://i.stack.imgur.com/KRNNn.png

I am unable to achieve the "silent" login part from chrome.

kytay 6 Reputation points

2020-09-08T08:08:46.453+00:00

To explain,
The client is a domain computer in the ADFS domain.
I have added "https://adfs.example.com" to trusted and intranet zone on client.
I have set ADFS to accept "Mozilla/5.0 (Windows NT)" agent on ADFS server
I have set ADFS to "extendedprotectiontokencheck allow" on ADFS server.

May I know if "silent" (unchallenged visually) login from Chrome browser to the ADFS is possible?

Thanks.
Sign in to comment

Share via

How to bypass SSO screen when using SAML 2.0 via ADFS

2 answers