0

SharePoint 2013 farm is configured to use SAML auth (WS-Fed) per following article: https://technet.microsoft.com/en-us/library/hh305235.aspx.

On the ADFS side the following relying parties (URLs and trust identifiers) and claim rules are created:

https://server_domain/_trust/
urn:sharepoint:server_domain

https://server_domain:8080/_trust/
urn:sharepoint:server_domain8080

At the SharePoint side new auth provider is created, also, according to this guide https://samlman.wordpress.com/2015/02/28/how-to-create-multiple-claims-auth-web-apps-in-a-single-sharepoint-2010-farm/ additional realms are added to auth provider (because there is more than one web application who is needed to use SAML auth):

$uri1 = New-object System.Uri("https://server_domain:8080")
$realm1 = "urn:sharepoint:server_domain8080"

$spti = Get-SPTrustedIdentityTokenIssuer -Identity "Staging ADFS"
$spti.ProviderRealms.add($uri1, $realm1)
$spti.Update()

The main problem is, when trying to access one root site collection using the following URL: https://server_domain, after redirecting to ADFS login page it redirect to https://server_domain/_layouts/15/start.aspx#/SitePages/Home.aspx, but when trying to access https://server_domain:8080, after ADFS login page it rediects back to https://server_domain/_layouts/15/start.aspx#/SitePages/Home.aspx, not to root site collection on https://server_domain:8080.

The final URL in the address bar should be https://server_domain:8080/_layouts/15/start.aspx#/SitePages/Home.aspx.

Also i've checked ADFS and see that one WS-Federation Passive protocol URL should be always set as default, the same i see when checking auth provider on SharePoint side using PowerShell:

Get-SPTrustedIdentityTokenIssuer -Identity "Staging ADFS"

ProviderUri                   : https://adfs_server_domain/adfs/ls
ProviderSignOutUri            : 
DefaultProviderRealm          : urn:sharepoint:server_domain
ProviderRealms                : {[https://server_domain:8080/, urn:sharepoint:server_domain8080]}
  • Please note that LogonTokenCacheExpirationWindow was changed to 1 minute on SharePoint server already and TokenLifetime was set to 5 on ADFS server. – Sergey Dec 3 '15 at 12:58
  • It looks like for ADFS server adresses server_domain and server_domain:8080 are not considered as a differnet URLs, it's still one FQDN and a token is issued for the first incoming request. – Sergey Dec 3 '15 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.