0

I'm working on SAML 2.0 (ADFS in OS 2016)based integration with my Application. I am using ADFS in OS2016 as my IDP. I'm able to do the integration successfully almost end-to-end except for 1 thing. The IDP is always sending the response to SP(my application) in SAML 1.1 format only instead of SAML 2.0 format.

As per the article below and 3 points mentioned ,I am concluding that the response I am getting is SAML 1.1only.(please clarify me if I am wrong)

http://saml.xml.org/differences-between-saml-2-0-and-1-1

  1.  The MajorVersion and MinorVersion attributes that appeared on various elements have been combined into a single Version attribute that has the value "2.0".

  2.  The <AuthenticationStatement> element has been renamed to <AuthnStatement>.

  3.  The AuthenticationMethod attribute has been replaced by the new structured <AuthnContext> element permitting the expression of new, very fine-grained authentication methods and other authentication-related information.

Below is my Response which I got it from IDP(ADFS in OS. 2016).

  1. wa: wsignin1.0

  2. wresult: <t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"><t:Lifetime><wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2020-06-26T04:57:32.190Z</wsu:Created><wsu:Expires xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2020-06-26T05:57:32.190Z</wsu:Expires></t:Lifetime><wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"><wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing">wsa:Addresshttps://SPmachineHost:9555/samllogin</wsa:Address></wsa:EndpointReference></wsp:AppliesTo><t:RequestedSecurityToken><saml:Assertion MajorVersion="1" MinorVersion="1" AssertionID="_18ed877c-5232-48cb-96fa-ee9f6a4052f1" Issuer="http://acs-adfs.acsadfs.local/adfs/services/trust" IssueInstant="2020-06-26T04:57:32.190Z" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"><saml:Conditions NotBefore="2020-06-26T04:57:32.190Z" NotOnOrAfter="2020-06-26T05:57:32.190Z">saml:AudienceRestrictionConditionsaml:Audiencehttps:// SPmachineHost:9555/samllogin</saml:Audience></saml:AudienceRestrictionCondition></saml:Conditions>saml:AttributeStatementsaml:Subjectsaml:SubjectConfirmationsaml:ConfirmationMethodurn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod></saml:SubjectConfirmation></saml:Subject><saml:Attribute AttributeName="name" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">saml:AttributeValueAdmin1</saml:AttributeValue></saml:Attribute></saml:AttributeStatement><saml:AuthenticationStatement AuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" AuthenticationInstant="2020-06-26T04:57:32.128Z">saml:Subjectsaml:SubjectConfirmationsaml:ConfirmationMethodurn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod></saml:SubjectConfirmation></saml:Subject></saml:AuthenticationStatement><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /><ds:Reference URI="#_18ed877c-5232-48cb-ee9f6052f1"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /><ds:DigestValue>80PFFLCrLFF8oL/MWx40FrZEx5A5w=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>MJd9e6ASmechzBC7jjnzV0mwP73n2GN3Dsz5GOEwPWzqzUlW+91O2QGQDrmnK8jVEN8RCylhJhUs42pjZpJmnse/jzse9NwJaLDgK2SjEDPJOQgYhYrS/Ax956B//40ZJzSZEiI7TeiQOdz3F2S2jwK9FV4rMcMwqAOKwC5uuZxKI2zTVN/l2p0TBrwXOm2a8za52k9YbhxsVw==</ds:SignatureValue>MIIC8DCCAdigAwIBAgIQF/6tTpRToJFN/3SNsFADA0MTIwMAYDVQQDEylBREZTIFNpZ25pbmMuY2FzbWFkZnNxYS5sb2NhbDAeFw0yMDAyMTAxMTQ0MzFaFw0yMTAyMDkxMTQ0MzFaMDQtYWRmcy5jYXNtYWRmc3FhLmxvY2FsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0mkhjInACpV9uKi5OuldVtszKTvd9bKK6Hb+r8iaU9WzpEu7IvRLz/alVvKmmjxvR3MX/K7lh8AzMNkA7fqU3prBvCJsVEPjS6mNIYNBfg6noDNAtXvlii+YML5Lt4GZKpY0miWW/eZPb+Q4eAPqhnWEywkRipAHCLZJjzMbX86ZfVghj69MwEvghHcODNIhSqkH6g814JCXiXQ+UrnF4A6Fn7n5dnD+rY4Qufv92Qnpv9fOAyY6m0m58nphD7gnXOWzs1NtUViMDjAQIDAQABMA0GBCwUAA4IBAQBzxTEnuJiK8ccfr8hOmEHRhdO6IPHEII8PE3+T6m3FTw4ELOOL4WTNpLiEylDNbnfkIvd/Jjigb6s/SKZn3BqA0rncxsjdILyCADyz9tEuU7Pl23Xnd3GA7049nK/0YddYFjsNtTUYiwNoFUXqh2hT+3dth5kBWdIPgoVwkf1HqMWtZCeaY/jOQgJUZ07O1zyvS3+mMRuFgJeZrS1bqfy2pMimS4TESpIFeKSBtZfyjfwZudfJdxdgfBEuZn0LTnmyQ/5TooWCoz</ds:Signature></saml:Assertion></t:RequestedSecurityToken><t:TokenType>urn:oasis:names:tc:SAML:1.0:assertion</t:TokenType><t:RequestType>http://schemas.xmlsoap.org/ws/2005/02/trust/Issue</t:RequestType><t:KeyType>http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey</t:KeyType></t:RequestSecurityTokenResponse>

  3. wctx: null

Any help on this will be a Great Help.

Thanks, Sekhar

sekhar
  • 1
  • 1
    By "OS2016" I think you probably mean "Windows Server 2016"? Q: What specific version of Windows Server? More importantly: Q: What specific version of Active Directory Federated Services? – FoggyDay Jun 26 '20 at 06:18
  • OS2016 means Windows Server 2016.I believe version of ADFS comes with Windows Server 2016 is ADFS4.0,Please correct me if I am wrong. – sekhar Jun 26 '20 at 13:42
  • While configuring Add Relying Party Trust on ADFS we have specified both 'Enable support for the WS-Federation Passive protocol' and 'Enable support for the SAML 2.0 WebSSO protocol' following on the "Configure URL" screen: • Select the "Enable support for the WS-Federation Passive protocol" check-box. • Entered the value in the "Relying party WS-Federation Passive protocol URL:" Select the "Enable support for the SAML 2.0 WebSSO protocol" check-box. • Entered the value in the "Relying party SAML 2.0 SSO service URL:" – sekhar Jun 26 '20 at 13:49
  • 1
    You are not using SAML at all, but you are using WS-Federation. Those are totally different protocols to achieve SSO. – Bernhard Thalmayr Jun 29 '20 at 11:04
  • Agreed. WS-Fed uses a SAML 1.1 token and that is what you are seeing. – rbrayb Jul 07 '20 at 04:05

0 Answers0