{"type":"doc","content":[{"type":"paragraph","content":[{"text":"The SP includes so-called \"RP\" support for the WS-Federation protocol as profiled by Microsoft in their older ADFS V1 product. The SP can act as a WS-Federation Passive Profile relying party in the same fashion that it supports SAML. All SP features not specific to the SAML protocol are supported equally for WS-Federation IdPs.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Not ADFS V2","type":"text"}]},{"type":"paragraph","content":[{"text":"This page is not relevant to use of ADFS V2 and beyond, which support a subset of SAML 2.0. The old ","type":"text"},{"text":"CommercialInterop","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.shibboleth.net/confluence/display/SHIB2/CommercialInterop"}}]},{"text":" page has information on SAML interoperation with Microsoft's implementation.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Metadata","type":"text"}]},{"type":"paragraph","content":[{"text":"Support for WS-Federation is currently provisioned and secured using the same metadata sources used for SAML. A profile of SAML metadata for use by WS-Federation peers was developed for the Shibboleth 1.3 release and remains supported.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SAML metadata profile for WS-Federation","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.shibboleth.net/confluence/display/SHIB/ADFSMetadataProfile"}}]}]}]}]},{"type":"paragraph","content":[{"text":"So the first step in enabling this support is to obtain or create metadata for the IdP following the profile. Without it, nothing will happen when you try to use the SP's features, or you'll get a metadata-related error.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Activating the ADFS Extension","type":"text"}]},{"type":"paragraph","content":[{"text":"The WS-Federation code for the SP is supplied in an extension that is included with the SP source code, and is built by default and included with binary packages. The extension is contained in two libraries, one for ","type":"text"},{"text":"shibd","type":"text","marks":[{"type":"code"}]},{"text":" and one for the web server filter/module. These are named ","type":"text"},{"text":"adfs.so","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"adfs-lite.so","type":"text","marks":[{"type":"code"}]},{"text":" respectively.","type":"text"}]},{"type":"paragraph","content":[{"text":"To load the extension, each library must be added to the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334388"}}]},{"text":" element in the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334599"}}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2063696243"}}]},{"text":" elements like so (the example isn't complete, only the relevant parts are shown):","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n\n\n \n \n \n","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Restart needed","type":"text"}]},{"type":"paragraph","content":[{"text":"Extensions are ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" loaded dynamically. You will need to restart the relevant services (web server for ","type":"text"},{"text":",","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"shibd","type":"text","marks":[{"type":"strong"}]},{"text":" for ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":") after adding the above configuration.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Enabling the WS-Federation Protocol","type":"text"}]},{"type":"paragraph","content":[{"text":"To enable the WS-Fed support, simply add the ","type":"text"},{"text":"ADFS","type":"text","marks":[{"type":"code"}]},{"text":" protocol token to the content of the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334348"}}]},{"text":" element (and if desired, the ","type":"text"},{"text":"","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334353"}}]},{"text":" element).","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Attribute Handling","type":"text"}]},{"type":"paragraph","content":[{"text":"As with most commercial SAML code, ADFS is a bit wonky in its support for SAML attributes. While Shibboleth makes no hardwired assumptions about attribute naming, most commercial code does. In the case of ADFS, a handful of built-in claims are included and any custom claims are generated with a proprietary AttributeNamespace value of ","type":"text"},{"text":"\"http://schemas.xmlsoap.org/claims\"","type":"text","marks":[{"type":"code"}]},{"text":". On the SP side, interoperation therefore requires that custom entries be added to the ","type":"text"},{"text":"attribute extraction configuration","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/SP3/pages/2065334409"}}]},{"text":" (typically ","type":"text"},{"text":"attribute-map.xml).","type":"text","marks":[{"type":"em"}]}]},{"type":"paragraph","content":[{"text":"To support ADFS claims passed as SAML attributes, you'll need to include the XML attribute/value of ","type":"text"},{"text":"nameFormat=\"http://schemas.xmlsoap.org/claims\"","type":"text","marks":[{"type":"code"}]},{"text":" inside each ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element that specifies an ADFS claim.","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n\n\n","type":"text"}]},{"type":"paragraph","content":[{"text":"These claims can be added alongside the existing SAML definitions and map to the same internal ","type":"text"},{"text":"id","type":"text","marks":[{"type":"code"}]},{"text":" so that applications are unaware of the distinction.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Name Identifiers","type":"text"}]},{"type":"paragraph","content":[{"text":"To access information passed within the subject of the assertion, the special ","type":"text"},{"text":"nameFormat","type":"text","marks":[{"type":"code"}]},{"text":" is unnecessary. The ","type":"text"},{"text":"Format","type":"text","marks":[{"type":"code"}]},{"text":" of the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" is placed into the mapping ","type":"text"},{"text":"name","type":"text","marks":[{"type":"code"}]},{"text":", per usual.","type":"text"}]}],"version":1}