1

**************EDIT****************

Muliple endpoints in the same relying trust is possible if the SPTrustedIdentityTokenIssuer has UseWReplyParameter enabled. This should help out with SharePoint Hosted Apps.

$tit = Get-SPTrustedIdentityTokenIssuer fs.contoso.com
$tit.UseWReplyParameter = $true
$tit.Update()

Please see the following blog: SharePoint and ADFS with SharePoint Hosted apps

**************EDIT****************

So I have configured an AD FS Relying Trust with multiple endpoints. Regardless of which endpoint I am coming from, AD FS redirects to the default endpoint. For example if someone is viewing a page within https://sp2013dev.com and clicks on their mysite, they are navigated back to https://sp2013dev.com. If I switch the endpoint such that MySites.sp2013dev.com is the default endpoint, users that browse to sp2013dev.com will instead be brought to the MySite Host.

AD FS Endpoints

******EDIT********

I configured my ProviderRealms for the TrustedIdentityTokenIssuer as follows TrustedIdentityTokenIssuer ProviderRealms

I also ensured that the Relying party identifiers included the URNs.

ADFS Relying Party Identifier URNs

******EDIT********

I tried configuring a wildcard endpoint but received an error stating that wildcard endpoints are not supported for the default endpoint.

Is there a way to configure separate endpoints for one Relying Party Trust or do I have to configure multiples?

5

Multiple endpoints in the same relying trust is possible if the SPTrustedIdentityTokenIssuer has UseWReplyParameter enabled. This should help out with SharePoint Hosted Apps.

$tit = Get-SPTrustedIdentityTokenIssuer fs.contoso.com
$tit.UseWReplyParameter = $true
$tit.Update()

Please see the following blog: SharePoint and ADFS with SharePoint Hosted apps

1

You have to configure the Seprate end point for each Web application.

 $ap1 = Get-SPTrustedIdentityTokenIssuer -identity "Adfs name"
$uri = new-object System.Uri("url of webapp/")
$ap1.ProviderRealms.Add($uri, "urn:sharepoint:MySite")
$ap1.Update()
8
  • That has been configured and I did an iisreset and cleared my cache. Is there something I need to do to get it to stick? Feb 25 '16 at 18:45
  • if you run this command $ap1.ProviderRealms can you see all your web apps
    – Waqas Sarwar MVP
    Feb 25 '16 at 18:46
  • 1
    that is problem, URN should be different for each web app
    – Waqas Sarwar MVP
    Feb 25 '16 at 18:50
  • 1
    did you create one package for all relying parties? I had issue in past where it is doing same thing, in my case URN mismatch with web application name...in Sharepoint name of web application is Mysite and in URN i mentioned MySite...case mismatch.
    – Waqas Sarwar MVP
    Feb 25 '16 at 19:09
  • 1
    try to create separate relying party registration for each url at adfs?
    – Waqas Sarwar MVP
    Feb 25 '16 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.