1

I wanted to understand whether Sharepoint 2016 supports the SAML 2.0 profile for authentication purposes.

I am not referring to an Azure based setup - I am referring to a setup where-in Sharepoint 2016 and ADFS (2.0/3.0) are installed within the enterprise and Sharepoint 2016 has been configured as a relying party to the ADFS STS.

Any pointers or links to the related documentation would be helpful

5

SharePoint 2016 does not support the SAML 2.0, you have to use the Saml 1.1, WS-Federation 1.1.

SAML token-based authentication in SharePoint Server 2016 uses the SAML 1.1 protocol and the WS-Federation Passive Requestor Profile (WS-F PRP). It requires coordination with administrators of a claims-based environment, whether it is your own internal environment or a partner environment. If you use Active Directory Federation Services (AD FS) 2.0, you have a SAML token-based authentication environment.

Plan for user authentication methods in SharePoint Server 2016

This is working as expected in Office 365 but not in on-prem.

We tried with SAML 2.0 and get the below error.SharePoint use the WS-Federation but we tried to conifgured it on SAML 2.0.

Exception details: Microsoft.IdentityServer.RequestFailedException: MSIS7012: An error occurred while processing the request. Contact your administrator for details. ---> Microsoft.IdentityServer.Service.SecurityTokenService.EmptyOrMissingWSFederationPassiveEndpointException: MSIS5004: The WSFederationPassiveEndpoint address is not configured on the relying party trust identified by the endpoint 'urn:sharepoint:KFA'. It is required to process the current request.
at Microsoft.IdentityServer.Web.Protocols.WSFederation.WSFederationProtocolHandler.ValidateAndUpdateReplyToForSigninMessage(MSISSignInRequestMessage& wsFedSigninRequest, WrappedHttpListenerRequest httpRequest)

  • Great answer and pointers. Thanks for this bit of information. – Prahalad Deshpande Dec 9 '16 at 4:55
  • @WaqasSarwarMCSE: when using official guide from MS here, Configure AD FS for a relying party, under profile selection, point #8, "Make sure Active Directory Federation Services (AD FS) 2.0 Profile is selected". If you look at the screen here http://www.screencast.com/t/CHXcpMRtc it's saying that SAML 2.0 actually supported. How to deal with that? – Sergei Sergeev Dec 9 '16 at 8:21
  • That is not correct. You can test it.saml 2.0 only support at office 365 not sharepoint on Prem – Waqas Sarwar MVP Dec 9 '16 at 12:13
2

Of course it's possible.
ADFS is so widely used across organizations, it would be strange if SharePoint 2016 don't support it.

Here is the link to overview for all authentication options availiable for SharePoint 2016 - Authentication overview for SharePoint Server 2016

UPD
It looks like SAML 2.0 is not supported based on the comment from @WaqasSarwarMCSE, so please use accepted answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.