The SP includes so-called "RP" support for the WS-Federation protocol as profiled by Microsoft in their ADFSv1 product. The SP can act as a WS-Federation Passive Profile relying party in the same fashion that it supports SAML. All SP features not specific to the SAML protocol are supported equally for WS-Federation IdPs.
Support for WS-Federation is currently provisioned and secured using the same metadata sources used for SAML. A profile of SAML metadata for use by WS-Federation peers was developed for the Shibboleth 1.3 release and remains supported in Shibboleth 2.0.
So the first step in enabling this support is to obtain or create metadata for the IdP following the profile. Without it, nothing will happen when you try to use the SP's features, or you'll get a metadata-related error.
Activating the ADFS Extension
The WS-Federation code for the SP is supplied in an extension that is included with the SP source code, and is built by default and included with binary packages. The extension is contained in two libraries, one for
shibd and one for the web server filter/module. These are named
Enabling the WS-Federation Protocol
Actually enabling the plugin requires some simple modifications to the handlers defined inside the
- Add a
type="ADFS"to one or more of your initiator chains.
It should be placed alongside or in place of the
"SAML2" plugins, in order of protocol preference.
- Add an [
Binding="http://schemas.xmlsoap.org/ws/2003/07/secext"to the list of endpoints. The
indexattribute is generally not important but should be unique.
- If you want to support SP-initiated logout using the WS-Federation signout protocol, then add a
type="ADFS"to one or more of your logout chains, ahead of the element with