How to bypass the Microsoft AAD login Screen for a Federated SSO User when access an AAD integrated application

31st of October, 2019 / John Yu / 1 Comment

As more organisations are integrating their SAML applications to AAD instead of ADFS to take advantage of the Azure AD Conditional Access Policy. One user experience issue of the change is that federated users (e.g. using ADFS for single-sign on) are first redirected to default MS AAD Login page. Only when they have entered their UPN, they are redirected to the ADFS page to sign in.

Many customers and end-users have asked if they can be redirected straight to the ADFS page, bypassing the MS login page, especially when migrating an existing ADFS federated application to AAD.… [Keep reading] “How to bypass the Microsoft AAD login Screen for a Federated SSO User when access an AAD integrated application”

AD FS 2016 and InvalidNameIDPolicy using SAML Authentication to SailPoint IdentityNow

4th of April, 2019 / Jesse Loudon / 2 Comments

I recently had a seemingly simple task for a customer to setup a AD FS 2016 relying party trust for their SailPoint IdentityNow deployment. Sounds easy right?

In this scenario AD FS 2016 was to be the Identity Provider (IdP) and IdentityNow the Service Provider (SP). Our end-goal of the solution was to allow the customer’s users to authenticate via SAML into IdentityNow using their corporate AD DS email address and password. Great outcome from a user experience perspective and for corporate governance too!… [Keep reading] “AD FS 2016 and InvalidNameIDPolicy using SAML Authentication to SailPoint IdentityNow”

AD FS 4.0 and the curious case of claim issuance policy naming: Notes from the field [Updated]

1st of April, 2019 / Lucian Franghiu / 2 Comments

The other day a colleague at Kloud, asked for a second set of eyes to look over and help with an Relying Party Trust setup in AD FS 4 (Server 2016). I obliged and went through a bunch of questions to try and determine what this issue might be.

To cut a long story short, the following is a quick bit of guidance when it comes to the naming of Claim Issuance Policies. I’ve found over the years that this can have a detrimental impact on configuration of an RPT if not setup with certain formatting.… [Keep reading] “AD FS 4.0 and the curious case of claim issuance policy naming: Notes from the field [Updated]”

Overcoming Issues Installing Azure Active Directory Connect

27th of November, 2018 / hughbadini / No Comments

AzureADConnect

Having recently gone through the process of implementing a custom AADConnect staging installation for a large enterprise customer with more than 30,000 users, with a view to it serving as a fall back to an existing production AADConnect installation.

The requirement being to setup an Azure virtual machine running Windows 2016 Datacentre, AADConnect and SQL Server Standard 2017 (locally installed). Rather than SQL Express which comes by default but suffers limitations which preclude its use in large environments.… [Keep reading] “Overcoming Issues Installing Azure Active Directory Connect”

Reporting on SailPoint IdentityNow Identities using the ‘Search’ (Beta) API and PowerShell

10th of September, 2018 / Darren Robinson / No Comments

Update: Oct 2019. Searching Identities can be easily performed using the SailPoint IdentityNow PowerShell Module.

Introduction

SailPoint recently made available in BETA their new Search functionality. There’s some great documentation around using the Search functions through the IdentityNow Portal on Compass^. Specifically;

^ Compass Access Required
Each of those articles are great, but they are centered around performing the search via the Portal. … [Keep reading] “Reporting on SailPoint IdentityNow Identities using the ‘Search’ (Beta) API and PowerShell”

Reporting on SailPoint IdentityNow Identities using the ‘Search’ (Beta) API and PowerShell

10th of September, 2018 / Darren Robinson / No Comments

Introduction

^ Compass Access Required

Each of those articles are great, but they are centered around performing the search via the Portal. For some of my needs, I need to do it via the API and that’s what I’ll cover in this post.… [Keep reading] “Reporting on SailPoint IdentityNow Identities using the ‘Search’ (Beta) API and PowerShell”

Auto-redirect ADFS 4.0 home realm discovery based on client IP

14th of June, 2018 / Adeel Nasir / No Comments

As I mentioned in my previous post here that I will explain how to auto-redirect the home realm discovery page to an ADFS namespace (claims provider trust) based on client’s IP so here I am.
Let’s say you have many ADFS servers (claims providers trusts) linked to a central ADFS 4.0 server and you want to auto-redirect the user to a linked ADFS server login page based on user’s IP instead of letting the user to choose a respective ADFS server from the list on the home realm discovery page as explained in the below request flow diagram.… [Keep reading] “Auto-redirect ADFS 4.0 home realm discovery based on client IP”

Some advanced ADFS 4.0 branding customization

23rd of May, 2018 / Adeel Nasir / No Comments

As you are aware that you can use some of the PowerShell commands to update the logo, banner/illustration images as well as home, privacy and other links of the ADFS 4.0 home realm discovery or sign in page. Below is an example of doing so
Set-AdfsWebTheme -TargetName custom -Logo @{path=”P:\Theme\Logo\logo.png”}

The above command would update the current logo image on the custom theme.
Set-AdfsGlobalWebContent -HomeLink https://{www.YourWebsite.Com}/ -HomeLinkText Home

Above command would update the “Home” link on all pages of your ADFS theme.… [Keep reading] “Some advanced ADFS 4.0 branding customization”

Display dropdown selection list on AD FS 4.0 Home Realm Discovery page

9th of May, 2018 / Adeel Nasir / No Comments

On AD FS 2.0 or 3.0 home realm discovery page, there was an option to select the AD FS namespace from a dropdown list. But in AD FS 4.0 it has been changed to HTML DIVs and sometimes it can be annoying if you have many (100s) of claims provider trusts available to choose from. So there is a customization required to change the HTML DIVs selection to a dropdown list selection.
Before doing the customizations, the HRD page selection section looks like:

In AD FS 4.0 this customization can be done in an “onload.js”… [Keep reading] “Display dropdown selection list on AD FS 4.0 Home Realm Discovery page”

ADFS Service Communication Certificate Renewal Steps

17th of September, 2017 / Moazzam Ali / 3 Comments

Hi Guys, adfs service comprises of certificates which serve different purpose for federation service. In this blog post I will share a brief description of these certificates, their purpose and will discuss renewal process of service communication certificate.

Type of ADFS Certificates and their purpose

Certificate Type	Description	Purpose
Service Communication certificate	Standard Secure Sockets Layer (SSL) certificate that is used for securing communications between federation servers, clients, Web Application Proxy, and federation server proxy computers.

… [Keep reading]