ADFS

Updating ADFS Federation Configuration

When communicating with an ADFS store via SAML, the process (SAML v2 redirect flow) is:

• User comes to MeTL unauthenticated
• MeTL sends user to IDP (IDentity Provider) [MeTL configuration for the location of the IDP]
• IDP needs to agree that it will send assertions to MeTL [IDP configuration]
• IDP provides the user with an assertion packet to give to MeTL [IDP signed with private key for which MeTL has public key, via IDP relaying trust config]
• User comes to MeTL with an assertion, which tells MeTL who the user is
• MeTL uses public key to validate that the assertion hasn't been tampered with [MeTL public key for IDP]
• MeTL gets some attributes from the packet (eg username, groups)

There are two ways of configuring a service provider for an IDP.

1. The non-Microsoft way which requires knowledge of the IDP (federation metadata), and the public key
2. The Microsoft way which provides the knowledge of the IDP via a publicly accessible endpoint along with the public key

Problem: The IDP has invalidated the current public key

HTTP ERROR 500 Problem accessing /saml-callback. Reason: No valid subject assertion found in response

Solution: Get a new one and reconfigure MeTL

• Log on to production via bastion jumpbox
• Go to /srv/jetty/appConf folder
• Rename existing federationmetadata.xml to federationmetadata-<YYYYMMDD>.xml sudo mv federationmetadata.xml federationmetadata.xml.<YYYYMMDD>
• Get the new federation metadata from: sudo wget https://fs.saintleo.edu/federationmetadata/2007-06/FederationMetadata.xml -O federationmetadata.xml
• Change ownership: sudo chown metl:metl federationmetadata.xml
• Restart server: /etc/init.d/jetty restart