Azure Portal: SSO initiated login with external provider
up vote
1
down vote
favorite
I successfully configured Azure to work with an external IdP according to https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp
However if I try to do an IdP initiated login, it seems that the SSO service https://login.microsoftonline.com does not parse the RelayState
accordingly to http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html#5.1.4.IdP-Initiated%20SSO:%20%20POST%20Binding|outline
If I use the IdP initiated login URL:
https://my-sso-idp.cloud/saml2/idp/SSOService.php?spentityid=urn:federation:MicrosoftOnline&RelayState=https://portal.azure.com
the login works fine, but then I get redirect to https://www.office.com/?auth=2&home=1
If I finally type https://portal.azure.com in the same browser tab, I can access the Azure portal due to already successfully logged in via SSO.
Does anybody know why the Micrsoft SSO ignores the RelayState argument?
Cheers Jonas
office365 azure microsoft single-sign-on
asked Nov 26 at 14:07
Jonas Weismueller
61
add a comment |
up vote
1
down vote
favorite
I successfully configured Azure to work with an external IdP according to https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp
However if I try to do an IdP initiated login, it seems that the SSO service https://login.microsoftonline.com does not parse the RelayState
accordingly to http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html#5.1.4.IdP-Initiated%20SSO:%20%20POST%20Binding|outline
If I use the IdP initiated login URL:
https://my-sso-idp.cloud/saml2/idp/SSOService.php?spentityid=urn:federation:MicrosoftOnline&RelayState=https://portal.azure.com
the login works fine, but then I get redirect to https://www.office.com/?auth=2&home=1
If I finally type https://portal.azure.com in the same browser tab, I can access the Azure portal due to already successfully logged in via SSO.
Does anybody know why the Micrsoft SSO ignores the RelayState argument?
Cheers Jonas
office365 azure microsoft single-sign-on
asked Nov 26 at 14:07
Jonas Weismueller
61
add a comment |
up vote
1
down vote
favorite
up vote
1
down vote
favorite
I successfully configured Azure to work with an external IdP according to https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp
However if I try to do an IdP initiated login, it seems that the SSO service https://login.microsoftonline.com does not parse the RelayState
accordingly to http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html#5.1.4.IdP-Initiated%20SSO:%20%20POST%20Binding|outline
If I use the IdP initiated login URL:
https://my-sso-idp.cloud/saml2/idp/SSOService.php?spentityid=urn:federation:MicrosoftOnline&RelayState=https://portal.azure.com
the login works fine, but then I get redirect to https://www.office.com/?auth=2&home=1
If I finally type https://portal.azure.com in the same browser tab, I can access the Azure portal due to already successfully logged in via SSO.
Does anybody know why the Micrsoft SSO ignores the RelayState argument?
Cheers Jonas
office365 azure microsoft single-sign-on
asked Nov 26 at 14:07
Jonas Weismueller
61
I successfully configured Azure to work with an external IdP according to https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp
However if I try to do an IdP initiated login, it seems that the SSO service https://login.microsoftonline.com does not parse the RelayState
accordingly to http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html#5.1.4.IdP-Initiated%20SSO:%20%20POST%20Binding|outline
If I use the IdP initiated login URL:
https://my-sso-idp.cloud/saml2/idp/SSOService.php?spentityid=urn:federation:MicrosoftOnline&RelayState=https://portal.azure.com
the login works fine, but then I get redirect to https://www.office.com/?auth=2&home=1
If I finally type https://portal.azure.com in the same browser tab, I can access the Azure portal due to already successfully logged in via SSO.
Does anybody know why the Micrsoft SSO ignores the RelayState argument?
Cheers Jonas
office365 azure microsoft single-sign-on
office365 azure microsoft single-sign-on
asked Nov 26 at 14:07
Jonas Weismueller
61
asked Nov 26 at 14:07
Jonas Weismueller
61
edited Nov 26 at 17:35
asked Nov 26 at 14:07
Jonas Weismueller
61
asked Nov 26 at 14:07
Jonas Weismueller
61
asked Nov 26 at 14:07
Jonas Weismueller
61
61
add a comment |
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1378482%2fazure-portal-sso-initiated-login-with-external-provider%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
