ADFS4.0如何将ConsumerAssertionUrl在AuthNRequest中发送到ClaimsProvider (IDP)

Question

我尝试在将AuthNRequest发送到SamL 2.0 IdentityProvider (ClaimsProvider)的前提下配置ADFS4.0 (2016)。AssertionConsumerServiceURL需要在IdentityProvider中使用AuthNRequest

我尝试使用several的几个组合，但是它没有在ADFS AuthN请求发送到IDP中包含所需的属性。

我使用下面的Powershell更新ADFS Claimsprovider

Set-ADFSClaimsProviderTrust -TargetIdentifier "https://idpsite/sps/sadidp01/saml20“-Name MYIDP”https://idpsite/sps/sadidp01/saml20“Url

Microsoft对-SamlAuthenticationRequestParameters的解释：

指定在对索赔提供程序的SAML身份验证请求中使用的下列参数之一：AssertionConsumerServiceUrl__，、AssertionConsumerServiceIndex和ProtocolBinding。

https://learn.microsoft.com/en-us/powershell/module/adfs/set-adfsclaimsprovidertrust?view=win10-ps

从ADFS发送的示例AuthN请求缺少AssertionConsumerServiceURL：

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="id-4ba0a2a8-9d62-4dbe-94aa-709f6e188e07" Version="2.0" IssueInstant="2019-02-02T08:01:48.299Z" Destination="https://idpsite/was90ssl/b2bidp/saml2f" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified">
   <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://myadfs/adfs/services/trust</Issuer>
   <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:SignedInfo>
         <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
         <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
         <ds:Reference URI="#id-4ba0a2a8-9d62-4dbe-94aa-709f6e188e07">
            <ds:Transforms>
               <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
               <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            </ds:Transforms>
            <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
            <ds:DigestValue>voe5M2YqcIhQIVv77kOKe2cd3UQEaZDqqLuDeDZ7feE=</ds:DigestValue>
         </ds:Reference>
      </ds:SignedInfo>

   <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true" />
</samlp:AuthnRequest>

如何将ConsumerAssertionUrl包含在ADFS AuthN请求中？

Answer 1

必须将ProtocolBinding设置为WSFED-SAML或SAML。