0

I have a big doubt in how to make the following configuration work correctly.

I have 2 SharePoint farms, one application per each farm:

  1. Dev Enviroment - My web app (dev version) https://url.comdev
  2. Prod Environment - My web app (prod version) https://url.com

The two applications are identical and both environment are accessed by users coming a unique Active Directory (we don't have a dev user domain).

I have asked the creation of two relying party trust in an existing ADFS and I have configured a standard trusted token issuer on SharePoint. I was given a single relaying party trust configured in the following way:

WS Federation Passive Endpoint: https://url.com/_trust/

Identifiers:

Given $ap* my SP Identity Trusted Token Issuers, my configuration was in Prod:

$id1 = "urn:sp:url.com"
$uri1 = new-object System.Uri("https://url.com")
$ap_prod.ProviderRealms.Add($uri1, $id1)
$ap_prod.Update()

And in Dev:

$id2 = "urn:sp:url.comdev"
$uri2 = new-object System.Uri("https://url.comdev")
$ap_dev.ProviderRealms.Add($uri2, $id2)
$ap_dev.Update()

Such configuration was not working in Dev, after sts authenitcation I was redirected to https://url.com/trust/.

Searching online I discovered the parameter UseWReplyParameter, and I run command only the following only in Dev:

$ap_dev.UseWReplyParameter = $true
$ap_dev.Update()

The configuration not seems working. Is this correct or do I have to configure the same way also the Prod farm? Which are the potential problem if I don't. Thank you!!

0

What i am thinking, You need the separate ADFS packages for each farm.I dont think it is recommend way to use the single package for two farm.

With in Single farm, you can do it the way you are implementing using the usewreplyparameter.

  • Ok, so I actually need to ask the ADFS admins to review their package configuration. Is there any documentation on it to use as reference? :) – Mafalda89 Apr 4 '16 at 16:27
  • Other quick question. The WS Passive Endpoint for SharePoint web app needs to be formatted as _trust/ or is it fine to write it as _trust the same way? My lack of knowledge on the subject tent to confuse the details. – Mafalda89 Apr 4 '16 at 16:31
  • it should be like this .com/_trust/ – Waqas Sarwar MVP Apr 4 '16 at 16:43
  • Thank you again! May I ask you why? – Mafalda89 Apr 4 '16 at 16:44
  • i am not sure why but here is MSFT: In the WS-Federation Passive protocol URL field, type the name of the web application URL, and append /_trust/ (for example, https:// app1.contoso.com/_trust/). Click Next" technet.microsoft.com/en-us/library/… – Waqas Sarwar MVP Apr 4 '16 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.