How To: Combine Two Realms' Workflows with a Redirect Token and Adaptive Authentication

Version Affected: All

 

Overview

Some workflows require combining the functionality of two different realms into a single sign-on experience for the user, without relying on the deprecated multiple-workflow function. This article explains how to use a redirect token together with Adaptive Authentication's User/Group Restriction to combine two realms' workflows while still reaching a single post-authentication step. The pre-auth token created in one realm is passed to a second realm for its own workflow, then passed back to the first realm for post-authentication.

Combine Two Realms' Workflows with a Redirect Token

In this example, Realm 2 is the realm the user starts at, and Realm 1 is the second realm its Adaptive Authentication redirects to for users outside a chosen group.

1. On Realm 2's Workflow tab, go to the Adaptive Authentication section and enable User/Group Restriction under User/Group. This carries the token created during Realm 2's pre-auth process over to Realm 1, so the user isn't asked for their username and password again.
   
   Set Group List to Allow a specific group (for example, TwoFactor): any user in that group continues straight through Realm 2's own workflow to post-authentication, and any user not in that group is redirected instead to Realm 1's workflow, via Failure Action: Redirect set to:

   RedirectWithToken.aspx?ReturnURL=/SecureAuth1

   
2. On Realm 1 (the realm Realm 2's Failure Action redirects to), go to its Post Authentication tab and set Authenticated User Redirect to Use Custom Redirect. In Redirect To, set a relative path that sends the token back to Realm 2's own post-authentication page:

   ../SecureAuth2/Authorized/SAML20SPInitPost.aspx

   

Once both realms are configured, the workflow behaves as follows: users in the TwoFactor group continue directly through Realm 2's own workflow to Realm 2 post-authentication. Users outside that group are redirected to Realm 1's workflow, reach Realm 1 post-authentication, and Realm 1's custom redirect then sends them back to Realm 2 post-authentication — so both paths end up completing the same post-authentication step.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.