Azure Active Directory
An Azure enterprise identity service that provides single sign-on and multi-factor authentication.
13,560 questions
SAML SSO Binding Type
Andris
11
Reputation points
In Azure AAD under Enterprise applications for SSO configuration (SAML) is it possible to configure Binding type order, which is represented in Federation Metadata XML file.
In these order our application is not working properly:
<SingleLogoutService Location="https://login.microsoftonline.com/7705c2da-6189-44e0-8946-27cb4b13dfb7/saml2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
<SingleSignOnService Location="https://login.microsoftonline.com/7705c2da-6189-44e0-8946-27cb4b13dfb7/saml2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
<SingleSignOnService Location="https://login.microsoftonline.com/7705c2da-6189-44e0-8946-27cb4b13dfb7/saml2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
When we are changing order manually in Federation Metadata XML file, application is working:
<SingleSignOnService Location="https://login.microsoftonline.com/7705c2da-6189-44e0-8946-27cb4b13dfb7/saml2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
<SingleLogoutService Location="https://login.microsoftonline.com/7705c2da-6189-44e0-8946-27cb4b13dfb7/saml2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
<SingleSignOnService Location="https://login.microsoftonline.com/7705c2da-6189-44e0-8946-27cb4b13dfb7/saml2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
HTTP-Redirect and HTTP-POST order for SingleSignOnService.
1 vote
-
Andris 11 Reputation points
2022-08-30T14:54:46.69+00:00 With the original metadata our app performs redirect and it's rejected by Azure CORS policy.
Hi @Andris , what do you mean by "not working properly?" Are you getting an error code? I'm a bit confused by your question. Are you asking why this is happening or how you can fix it? Because you have it working properly in the below example. Please let me know and I can help you further.
Thank you,
James
the IdP metadata generated by Azure provides Binding order with Redirect over POST meaning that Service Provider should use redirect (302 instruction) in order to navigate user to IdP in case of wrong/expired SAML token. At the same time, Azure IdP blocks such IdP redirects by it's own CORS policy making Redirect instruction pointless. The only way we found to overcome this is changing Binding order in Azure metadata file by moving POST Binding first to increase it's priority. With POST binding, there is no redirect and we don't face rejection by CORS from Azure. This approach includes manual modification of metadata file provided by Azure, which we believe is not the best way to proceed.
In this situation, we see two options:
Force Azure IdP to generate metadata with POST Binding having highest priority.
Force Azure IdP to accept 302 redirects from our SP host.
For both we don't know if there is any setting to accomplish that. Please guide what we can do to avoid manual modifications of metadata file.
Is there any news regarding these ?
Sign in to comment