ADFS RelayState (IdP-initiated sign-on deep links)
The university, as part of its digital strategy initiative, is pushing harder than ever for SSO across its major services. Part of this means standardizing on an IdP infrastructure to tie everything into, and for a lot of reasons (future post) we chose ADFS.
Recently a service provider asked us if, since we are working this way with our Shibboleth IdP now, we can provide a deep link on the IdP domain that will redirect to the SP after the authentication flow. I figured it was possible, but it was the first time we had to think about this with ADFS. Turns out it's quite easy, at least on ADFS v5 (Server 2019).
I'm probably explaining this wrong, but in SAML parlance the flow where the user connects to the IdP first and then gets punted to an SP is called RelayState, and typically it is triggered by appending a query string to the IdP-initiated sign-on page.
First, enable IdP-initiated sign-on if you haven't already:
For example, the relying party identifier http://www.gartner.com becomes:
https://fs.contoso.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Dhttp%253A%252F%252Fwww.gartner.com%26RelayState%3D
There is an excellent tool hosted by Jack Stromberg that will take your IdP-initiated sign-on endpoint and relying party identifier and generate the deep link for you.
Recently a service provider asked us if, since we are working this way with our Shibboleth IdP now, we can provide a deep link on the IdP domain that will redirect to the SP after the authentication flow. I figured it was possible, but it was the first time we had to think about this with ADFS. Turns out it's quite easy, at least on ADFS v5 (Server 2019).
I'm probably explaining this wrong, but in SAML parlance the flow where the user connects to the IdP first and then gets punted to an SP is called RelayState, and typically it is triggered by appending a query string to the IdP-initiated sign-on page.
First, enable IdP-initiated sign-on if you haven't already:
Set-AdfsProperties -EnableIdpInitiatedSignonPage $trueThen, enable RelayState:
Set-AdfsProperties -EnableRelayStateForIdpInitiatedSignOn $trueAll that remains is to compose your deep links. There's a Microsoft KB article (for as long as these things last) that explains in detail how the relying party identifier should be URL-encoded and appended to the IdP-initiated sign-on URL.
For example, the relying party identifier http://www.gartner.com becomes:
https://fs.contoso.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Dhttp%253A%252F%252Fwww.gartner.com%26RelayState%3D
There is an excellent tool hosted by Jack Stromberg that will take your IdP-initiated sign-on endpoint and relying party identifier and generate the deep link for you.
Comments
Post a Comment