My request URL look like this
https://adfs.plugins.local/adfs/ls?SAMLRequest=fVNNj9owEL3vr0C558MhnxZJRaG0SBQQ0B56qRzHZq06dmo73e2/r5PALl21+OBIM++9mXmezDRqeAvnnXkUB/KzI9o8TOx5brjQcEgWTqcElEgzDQVqiIYGw+P88waGXgBbJY3EkjtvaPdZSGuiDJNipK2XhbPbftjsPq6332mNQJTHdRTQKY7zMKFZnYA8TbMQgCiq4hREVZAEI/UrUdrqFI6VvYhp3ZG10AYJY8MBSN0gcwNwAjEMEwjCbyNuaWdlApmB/WhMq6Hvo5pqr+XdmQntcYkRH0I+1yNpfxn3PRM1E+f7U1YjSMNPp9Pe3e+Op1Fkvlwdj0T9Iqpw4jylVZZndYYQiqLpNKM4mlJ6QV59Wkihu4aonsYw+XLYvPYM8tADSeZFXhgkft/8GVWcaL9/VSIMw8OQfl/2TYhLO+i7xfGwOskfRBRZWNV5FSE3JhS4EabYzUEauyCYBjXCOIlx5oI4AEkAwDS9Wl4O96x/dzjYr8qLh67WcubfJl6hLdxay9bLveQM/x7i/VlJ1SDzf2eBB4YIq106QGEndEswo4zUzovMnHP5tFAEGVI4RnXEmfh/Fb+sO6mH5bcGG/JsJgvZtEgx3S8FeUbYOOWL5DjgLXzB7SYfCC3vLjuGuMfZ8N5+nqSq+zUi2NY+KWSbl8pcTPqn+Ni1f6ft8uGavv2Tyz8=&adfs_server=597fb898d8aaa44338fc43ff&RelayState=https://192.168.4.206/pluggables/Authentication/ADFSAuthentication/authenticate
I have passed a parameter called adfs_server but when I got the response the adfs_server parameter was not present.
So is it possible or not?
This is SAML.
There is no parameter in the SAML protocol called "adfs_server" so it is ignored.
Related
Is there a way to have the redirection callback from Google SSO made as a POST request instead of a GET request, that way all the parameters would be encoded in the body.
Microsoft allows it by changing the response_body parameter when creating the flow.
I built an app in my Azure ad b2c tenant and configured it as shown, but why can't I request an access token in postman?
app registration
API permissions
postman screenshot
Here are the links to the two documents I follow：
Register a Microsoft Graph application
Get access without a user
One thing I noticed is that the parameters for the token request should be in the body as form parameters, like this:
You should use the parameters you've defined here though, this screenshot shows a test request for the ROPC flow so the parameters in the picture are not valid for your use case.
So instead of entering the parameters in Params, enter them in Body tab after selecting x-www-form-urlencoded as the type.
Please input the params in "Body" tab of your postman but not "Params" tab. Shown as below screenshot.
In order to get token you need to pass grant_type in request body and value should be password.
For example
Method Post: https://login.microsoftonline.com/YourTenantID/oauth2/v2.0/token
And in body you need to ppass
client_id : Your app client ID
scope: user.read%20openid%20profile%20offline_access
username: Your username
password: your password
grant_type: password
client_secret: you app registration secret
I tried many times to put into body with JSON format or in parameter or put into Parameters, but I did not work. And it works for me when I put into Body with type is x-www-form-urlendcoded.
[Image]: https://i.stack.imgur.com/tguZc.png
I am building an Azure Functions application that authenticates with the Microsoft Graph API. I've created a processCode function that acts as my redirect URI, which takes the code sent by Graph API to generate the Graph token.
However, Azure Functions use the code query string parameter in their calls to pass the function key.
Is it possible for me to configure the Graph API redirect URI to use a different query string parameter other than code?
Essentially, changing
https://myapp/api/processCode?code=GRAPH-CODE (conflicting code parameter)
to
https://myapp/api/processCode?code=FUNCTIONS-KEY&graphcode=GRAPH-CODE
You cannot. The code= query parameter is defined by the OAuth 2.0 specification (RFC 6249).
What you might be able to do instead is change your response_mode from query to form_post when you request the authoirzation code. This changes how the code itself gets returned. Rather than issuing a GET to your redirect_uri with the code in the authorization it issues a POST to the redirect_uri with the code in the body (i.e. application/x-www-form-urlencoded).
You'd have to adjust your Azure Function to listen for POST and parse the content from the body instead of the query string. Otherwise, everything should remain pretty much the same. The application/x-www-form-urlencoded closely resembles the query string format (key=value&key=value&etc).
Kentor - Using the SampleMvcApplication with success through their StubIdp but when I try with Clareity I receive the above error.
Without knowing anything about the implementations ( Kentor, SampleMvcApplication, StubIdP, Clareity )it looks as if:
Your Identity Provider implementation does not return a 'RelayState' parameter in the body of the HTTP POST along with the SAMLResponse.
Your Identity Provider implementation has added an InResponseTo attribute in the SAMLResponse element
Your Service Provider implementation interprets this as an IdP initiated SSO since it does not see a 'RelayState' parameter
Your Service Provider throws an error since it doesn't make sense for an SAMLResponse in an IdP initiated SSO flow to have an InResponseTo. InResponseTo refers to an AuthenticationRequest which is only there in a normal SP initiated SSO.
To get more help, you should tell us a little about the implementation you are using and your configuration.
I am using OAuth 2.0 for my AngularJS application. When the user clicks on one of other application I am redirecting to my Angular application with parameters like this:
https://stic-scm-auto.snitco.com/fsHardSoft/createCase?sn=FOC0948Y1WB
When above URL is accessed I am showing them the login page. (since they are not logged in yet)
Later I am redirecting them to here :
https://cloudsso-test.snitco.com/as/
after they landed there, I am getting re-directed to login URL:
https://sso-test.snitco.com/autho/forms/CDClogin.html
once the login succeeds, it's redirecting back to the OAuth callback page of my application.
How can I pass the createCase?sn=FOC0948Y1WB - parameter to all above gateways and get the data back?
You can achieve this by relying on OAuth 2.0 state parameter. In an OAuth 2.0 compliant server the value you send in this parameter we'll be returned to you after the process completes and the authorization server redirects back to your application.
The primary use case of this parameter is to prevent XSRF by linking an original request to the redirect request so that the client application is sure that the redirect was not caused by an attacker.
However, it's also possible to use this parameter to achieve per-request customization which in your case would be knowing the original case number. See Using the State Parameter for more information about this. Just be sure that the value passed in the state should still have a random component that can later be checked to prevent XSRF; your required custom data should be in addition to this nonce value.