Login into an aad-joined windows 10 computer with SAML 2.0 federated domain

GribouilleVert 96 Reputation points
2021-10-01T09:11:04.39+00:00

Hello,

I have an Azure Active Directory Tenant, on which the domain is federated through SAML 2.0. I would like to use this directory to manage windows 10 computers, but when I link the domain to the computer, i cannot login into the computer as it asks for a password which there isn't since the user is logged in through saml.

Is it possible to login into windows using the SAML 2.0 federated domain ?

Windows 10 Setup
Windows 10 Setup
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Setup: The procedures involved in preparing a software program or application to operate within a computer or mobile device.
1,902 questions
Microsoft Entra
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,457 questions
0 comments
Accepted answer
  1. GribouilleVert 96 Reputation points
    2021-10-04T09:52:58.377+00:00

    It seems that i've not been correctly explaining.

    I have successfully joined the computer to the AAD tenant and while using SAML 2.0, but when i want to log in into windows, it asks for username/password, which obviously cannot work as the account uses the SAML 2.0 serveur to authenticate. I have successfully federated the domain, this is not the issue, the issue is that, after joining the computer to the tenant, i cannot login using aad's accounts, the only account that works is the local computer administrator.

    I'm not sure if i've been clear, so i'll clear it up, here Azure Active Directory is a Service Provider, the SAML Identity Provider is a standalone, custom SAML 2.0 php implementation. Therefore when logging in, AAD redirects the user (through HTTP) to the IDP for identification.

4 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. VipulSparsh-MSFT 16,231 Reputation points Microsoft Employee
    2021-10-04T05:01:52.59+00:00

    @GribouilleVert The machine needs to be Azure AD join or Hybrid Join State in order to login to Windows 10 machine using federated state.
    If you are using ADFS as federation server.

    Windows 10 login need WS-trust username/mixed endpoints to be enabled in ADFS, please check if you have them enabled, If not, please enable them on endpoints and try again. Can you get the list of all ADFS endpoints and share what are the current configurations ? Thanks.

    0 comments
  2. GribouilleVert 96 Reputation points
    2021-10-04T08:04:07.04+00:00

    @VipulSparsh-MSFT I do not use a local Active Directory server, my federation is a custom implementation of the SAML 2.0 protocol. It is available at gateway.vasco.network (https://gateway.vasco.network/saml/metadata.xml).

    The only config i can provide you is the SAML server one (which i doubt will be of any use).

    0 comments
  3. Limitless Technology 39,351 Reputation points
    2021-10-04T09:16:30.807+00:00

    Hi there,

    Yes, you can log in to windows using the SAML 2.0 federated domain . The Microsoft identity platform uses the SAML 2.0 protocol to enable applications to provide a single sign-on experience to their users.

    Use a SAML 2.0 Identity Provider (IdP) for Single Sign-On
    https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp

    Federation with SAML/WS-Fed identity providers for guest users
    https://learn.microsoft.com/en-us/azure/active-directory/external-identities/direct-federation

    ---------------------------------------------------------------------------------------------------------------------

    If the reply is helpful, please Upvote and Accept it as an answer

    0 comments
  4. GribouilleVert 96 Reputation points
    2021-10-05T06:28:50.717+00:00

    Ow ! Ok, well thank you very much !

    0 comments