Page Comparison

The SP includes so-called "RP" support for the WS-Federation protocol as profiled by Microsoft in their ADFSv1 product. The SP can act as a WS-Federation Passive Profile relying party in the same fashion that it supports SAML. All SP features not specific to the SAML protocol are supported equally for WS-Federation IdPs.

Metadata

Support for WS-Federation is currently provisioned and secured using the same metadata sources used for SAML. A profile of SAML metadata for use by WS-Federation peers was developed for the Shibboleth 1.3 release and remains supported in Shibboleth 2.0.

• SAML metadata profile for WS-Federation

So the first step in enabling this support is to obtain or create metadata for the IdP following the profile. Without it, nothing will happen when you try to use the SP's features, or you'll get a metadata-related error.

...

To load the extension, each library must be added to the <Extensions> element in the <OutOfProcess> and <InProcess> elements like so (the example isn't complete, only the relevant parts are shown):

<OutOfProcess>
    <Extensions>
        <Library path="adfs.so" fatal="true"/>
    </Extensions>
</OutOfProcess>
<InProcess>
    <Extensions>
        <Library path="adfs-lite.so" fatal="true"/>
    </Extensions>
</InProcess>

Enabling the WS-Federation Protocol (SP V2.4 and Above)

To enable the WS-Fed support on current SP versions, simply add the ADFS protocol token to the content of the <SSO> element (and if desired, the <Logout> element).

Enabling the WS-Federation Protocol

...

(SP Versions < V2.4)

On older versions, enabling the plugin requires some simple modifications to the handlers defined inside the <Sessions> element:

• Add an <md:AssertionConsumerService> with Binding="http://schemas.xmlsoap.org/ws/2003/07/secext" to the list of endpoints. The index attribute is generally not important but should be unique.

<md:AssertionConsumerService Location="/ADFS" index="10" Binding="http://schemas.xmlsoap.org/ws/2003/07/secext"/>

• Add a <SessionInitiator> with type="ADFS" to one or more of your initiator chains.

<!-- If outside of a chain, add Location="/Login" -->
<SessionInitiator type="ADFS" acsIndex="10"/>

...

• If you want to support SP-initiated logout using the WS-Federation signout protocol, then add a <LogoutInitiator> with type="ADFS" to one or more of your logout chains, ahead of the element with type="Local".

<!-- If outside of a chain, add Location="/Logout" -->
<LogoutInitiator type="ADFS"/>

...

To support ADFS claims passed as SAML attributes, you'll need to include the XML attribute/value of nameFormat="http://schemas.xmlsoap.org/claims" inside each <Attribute> element that specifies an ADFS claim.

    <!-- WS-Fed attributes -->
    <Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="CommonName" id="cn"/>
    <Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="EmailAddress" id="email"/>
    <Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="UPN" id="userPrincipalName"/>
    <Attribute nameFormat="http://schemas.xmlsoap.org/claims" name="Group" id="group"/>

...