SAML | ADFS troubleshooting and tips (Auto Login with ADFS in Intranet, mobile app user agent fix, etc.)
Tips:
Steps to enable Auto-logon:
Step 1: In the AD FS server, under Authentication Methods, make sure that Windows Authentication is selected.
Step 2: Run the below powershell query to check if "Chrome" is present in the supported WIA agents:
Get-AdfsProperties | Select -ExpandProperty WIASupportedUserAgents
If Chrome is not present, then the following query can be run to add chrome to the supported user agents.
Set-AdfsProperties -WIASupportedUserAgents ((Get-ADFSProperties | Select -ExpandProperty WIASupportedUserAgents) + "Chrome")
Step 3:
In the client machine (user machine), open Internet Options and add your ADFS URL in Local intranet Sites (or under Trusted Sites if your url is in https)
Step 4:
Click on Custom Level... and under User Authentication -> Logon -> choose Automatic Logon with current username and password
Once these settings are saved, your ADFS will directly use your machine credentials when you are in your intranet and when you're connected to the internet, the following popup will be shown, which still can be used to log in to ADFS.
For Firefox an extra setting is required. Go to about:config and search for trusted-uri where your ADFS machine's fully qualified name needs to be added.
To skip Login page of SDP too:
Please follow this KB:
Known Issues with Mobile Apps:
After turning on Windows Authentication, mobile apps may not work as their user agents also get matched for Windows Authentication which fails.
Solution:
Since the ADFS user agents accept regular expressions, you may write one that skips Android and iOS agents but allows Laptops and PCs.
Here is an example for reference (the =~ shows that it is a regex understood by ADFS):
=~^((?!Android|iPhone).)*$
To set this, you can run the below command in powershell (make sure to take a backup of existing properties)
Set-AdfsProperties -WIASupportedUserAgents "=~^((?!Android|iPhone).)*$"
Troubleshooting:
1. No name id found in Document:
Cause: This may be because ADFS is sending encrypted document.
Fix: Please remove any certificates present in the encryption tab of ADFS
New to ADSelfService Plus?
Related Articles
Configuring SAML with ADFS
Step 1: Open the ADFS management application Step 2: Right-click Relying Party trust and choose Add Relying Party Trust. The Add Relying Party Trust Wizard opens. Step 3: Choose Claims Aware and click Start Step 4: Choose Enter data about the relying ...SAML | Multiple Login URLs for SAML Response
Issue: Even if SDP can be accessed with multiple URLs like internal.servicedesk.com and external.servicedesk.com, the SAML response is always received at the same URL that is configured in Alias URL. Fix: The acs_url column in the SAMLSP table can be ...SAML | Skip login page | Login directly with SAML | Query to enable AD or Local Auth during SAML issues
Issue: When users have AD and/or local authentication enabled along with SAML, the login page is shown when a link from an email is clicked and users need to click "Login with SAML" again. Workaround 1: You can bookmark, <sdp_url>/SamlRequestServlet ...SAML | Configure KeyCloak as IDP
Setting up KeyCloak Download KeyCloak from their official website (Used v25 here). Open conf/keycloak.conf and enter the hostname Run sh kc.sh start-dev Create a user and login at http://localhost:8080 Setting up the IDP: To enable logging, go to ...Login | Access ServiceDesk APIs over Azure Pre Auth with Entra ID as Pre Authentication
Challenge: When the application is hosted over Azure Pre Authentication with Entra ID as Pre-Authentication, all the REST APIs would fail to work. Workaround: As suggested by Microsoft, we can obtain the id_token by using the scope ...