One example where this may be necessary is if you have one ADFS server that is a sort of hub for other ADFS servers being used. If we follow this scenario out, suppose you have multiple web applications in SharePoint, and for each one your users should authenticate against a different Active Directory forest via ADFS. Well, using the procedures I described in the previous posting, you can create the trusts in ADFS to make that scenario work. However, the first time your users navigate to the SharePoint site that uses that hub ADFS server, or if they use the In Private features of IE to navigate to the site, they will get an intermediary page from ADFS before they log on. That intermediary page will list ALL of the claims identity providers and ask the user to select the one against which they wish to authenticate. Then they are redirected over to the login page for that identity provider (IP).
In a perfect world though, we don't want users to see that intermediary page - we'd rather redirect them immediately to the correct IP for authentication. Fortunately ADFS provides support for this through a "whr" query string parameter. If you add this query string parameter when navigating to ADFS then it will do a look up of the whr parameter to find a matching IP. If it finds one, then it automatically redirects you to that IP. In ADFS 1.x that parameter was a URN, like urn:foo:monkey. In ADFS 2.0 it takes the format of a Uri. To find the value you should use for the whr query string parameter, open up the AD FS 2.0 Management application. Expand the Trust Relationships...Claims Provider Trusts node, then double-click on the IP that you want used. Click on the Identifiers tab and you will see a grayed out edit box called Claims provider identifier:. The value in there is what should be in your whr query string parameter. For example, in my environment the IP identifier is http://tgen1.terri.local/adfs/services/trust. In order to get users of a web application to redirect immediately over to that IP I need to append the following to the normal login query string that SharePoint uses: &whr=http://tgen1.terri.local/adfs/services/trust When I do that I no longer see the IP selection page in ADFS, I just go directly to logging in.
In a perfect world though, we don't want users to see that intermediary page - we'd rather redirect them immediately to the correct IP for authentication. Fortunately ADFS provides support for this through a "whr" query string parameter. If you add this query string parameter when navigating to ADFS then it will do a look up of the whr parameter to find a matching IP. If it finds one, then it automatically redirects you to that IP. In ADFS 1.x that parameter was a URN, like urn:foo:monkey. In ADFS 2.0 it takes the format of a Uri. To find the value you should use for the whr query string parameter, open up the AD FS 2.0 Management application. Expand the Trust Relationships...Claims Provider Trusts node, then double-click on the IP that you want used. Click on the Identifiers tab and you will see a grayed out edit box called Claims provider identifier:. The value in there is what should be in your whr query string parameter. For example, in my environment the IP identifier is http://tgen1.terri.local/adfs/services/trust. In order to get users of a web application to redirect immediately over to that IP I need to append the following to the normal login query string that SharePoint uses: &whr=http://tgen1.terri.local/adfs/services/trust When I do that I no longer see the IP selection page in ADFS, I just go directly to logging in.
More Here
Courtesy:http://blogs.technet.com/b/speschka/archive/2010/11/24/configuring-sharepoint-to-use-a-specific-identity-provider-in-adfs.aspx
Hi ... william.. thanks for sharing information.This has to be one of my favorite posts! And on top of thats its also very helpful topic for newbies. Thanks a lot for informative information on sharepoint.
ReplyDeleteWhen you have one ADFS server acting as a sort of hub for other ADFS servers in operation, for instance, this might be required.
ReplyDeleteJohn Abraham, Check my site