How To: Use the Saml Consumer with a WSFed realm, retaining the AuthN.

Version Affected:  All

Description:  

Office Apps on Mobiles, such as Outlook only work if you keep the WSFed query string. 

However, if using a Saml Consumer realm, this gets lost with the redirects and so the Outlook App fails to work.

Cause:  In this unusual workflow, the redirect to the 3rd Party IdP and the assertion it returns to our SAML consumer means that the WSFed Query String is lost. 

Resolution:  

The first realm that you hit will save the values from the query string as part of the ASP session. 

However, to retrieve this, you have to set it up in a certain way.

You will need
The WSFed realm
The Saml Consumer realm

1. On the WSfed Realm, set a begin site that redirects to the saml consumer realm.

2. On the Saml Consumer realm, set a begin site that redirects to the 3rd Party IdP.

3. On the Saml Consumer realm, set the Post Auth action to custom redirect and point to the root of your WSfed realm. eg, ../SecureAuth1/

4. Match the Forms Auth Encryption and Validation keys across the two realms. 

5. Set the Pre-Auth Cookie on the WSFed realm to match the PostAuth cookie name of the Saml Consumer realm.

6. On the Workflow tab of the WSFed realm, set the Receive Token to Token. 

7. Set the Workflow to Username & Password or Username & Password | 2nd Factor.

This gives the workflow of 

SP > SecureAuth > 3rd Party Idp > SecureAuth > SP 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.