To complete the integration of AD FS-federated applications with Workspace ONE Intelligent Hub, you must enable the RelayState parameter in AD FS. This parameter passes an application's relying party identifier from Omnissa Access to AD FS, so that AD FS can redirect users to the application portal.
Without the RelayState parameter enabled, users can click an AD FS-federated application in the Hub portal and authenticate into AD FS through Omnissa Access. However, they are not further redirected to the application portal.
With RelayState enabled, an IdP-initiated authentication flow follows this sequence:
- End user requests access to an AD FS-federated application in the Hub portal.
- Omnissa Access sends an IdP-initiated authentication response to AD FS. This SAML response contains a RelayState value set to the relying party identifier of the application.
- AD FS accepts the authentication response and redirects the user to the application portal specified by the RelayState value.
- User is granted access to the application.
For more information about IdP-initiated authentication flows, see IdP-initiated and SP-Initiated Authentication Flows. For more information about RelayState support in AD FS, see the following links:
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/jj127245(v=ws.10)
- http://www.expta.com/2014/11/how-to-enable-relaystate-in-adfs-20-and.html
- https://s4erka.wordpress.com/2018/01/24/relaystate-support-for-adfs-2016-in-the-mixed-mode-adfs-farm/
Prerequisites
Test the Omnissa Access Authentication
Procedure
-
On the AD FS server, open the file: %systemroot%\AD FS\Microsoft.IdentityServer.Servicehost.exe.config
-
Insert
<useRelayStateForIdpInitiatedSignOn enabled="true" />within the<microsoft.identityServer.web>section of the config file.
What to do next
Obtain the Relying Party Identifier for an AD FS-federated Application
Was this page helpful?