Hi Folks,
I am in the middle of a bank group SaaS migration. As a first wave we have to migrate from Managed to SaaS 3 subsidiaries with 8 environments (3-2-2).
Regarding the SAML integration we have tried the 3 possible integration types: Global, Account and Environment level. Final setup will be the Environment level one because of security and subsidiaries separation reasons.
Some tips and tricks...After the domain verifications we could started the configurations. We have already tired ADFS and MS Entra ID.
During the configurations a SAML tracer can help the indentify the issues. SAML request / SAML response can be cheked with these kind of tools. We had the most problems with the group claims.
Claims attribute mapping links can be found in the identity provider XML. So you need only check it in the XML file which was provided by the ADFS or MS Entra ID admins.
ADFS example:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
http://schemas.xmlsoap.org/claims/Group
MS ENTRA ID example:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
We had an extra configuration at ADFS side, after we created the ADFSRelyingPartyTrust in case of Account and Environment type configuration we had to run this PS command for the "XXX Target XXX" ADFSRelyingPartyTrust.
Set-ADFSRelyingPartyTrust -TargetName "XXX Target XXX" -SamlResponseSignature "MessageAndAssertion"
If your configuration is correct you can pass through on the Validation phase of the configuration. Important before the configuration or validation phase remove the validator user local user rights on the myaccount site if the user has any local user on the myaccount site.
Validation phase results in case of correct configuration:
I hope it helps for you in case of SAML integration.
Best regards,
János
Featured Posts
