Active Directory makes the authentication type 'special'. It's probably different depending on the type of AD you are using as well. The AuthenticationType parameter is how the linking of accounts works, and relies on that value being returned from the OAuth provider. This is also the value stored in the umbracoExternalLogin table.

The only real example I can give you is the snippet we use in Identity Extensions when configuring Azure AD OAuth, you can see that here: https://github.com/umbraco/UmbracoIdentityExtensions/blob/master/src/App_Start/UmbracoADAuthExtensions.cs#L65

You can also see in this snippet that ForUmbracoBackOffice is called before the AuthenticationType is set, since as you previously noted, ForUmbracoBackOffice will change the auth type provided to be prefixed - since this is needed for most oauth providers.

Hi Shannon

Thanks for your feedback. I got it working in the end. I just created a bug report here, before seing your answer: http://issues.umbraco.org/issue/U4-8848

The code base appears to be oauth centric when looking at naming conventions in both frontend and backend. I don't know if an override with a more generic approach could/should be implemented or you will OAuth everything?

Hi

i'm getting the same error The requested provider (http://myadfsdomain.com/adfs/services/trust) has not been linked to to an account

I've tried to setup the property wsFedOptions.AuthenticationType after the invocation of: wsFedOptions.ForUmbracoBackOffice(style, icon); But no luck.

i'm getting the below claims from the adfs server

1. nameidentifier
2. name
3. emailaddress

My code is

public void Configuration(IAppBuilder app)
        {
            var adfsMetadataEndpoint = ConfigurationManager.AppSettings["AdfsMetadataEndpoint"];
            var adfsRelyingParty = ConfigurationManager.AppSettings["AdfsRelyingParty"];
            var adfsFederationServerIdentifier = ConfigurationManager.AppSettings["AdfsFederationServerIdentifier"];

            app.ConfigureUserManagerForUmbracoBackOffice(
                ApplicationContext.Current,
                global::Umbraco.Core.Security.MembershipProviderExtensions.GetUsersMembershipProvider().AsUmbracoMembershipProvider());

            app
                .UseUmbracoBackOfficeCookieAuthentication(ApplicationContext.Current)
                .UseUmbracoBackOfficeExternalCookieAuthentication(ApplicationContext.Current);

            app.SetDefaultSignInAsAuthenticationType(Umbraco.Core.Constants.Security.BackOfficeExternalAuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie
            });

            var wsFedOptions = new WsFederationAuthenticationOptions
            {
                Wtrealm= adfsRelyingParty,
                MetadataAddress= adfsMetadataEndpoint,
                SignInAsAuthenticationType = Umbraco.Core.Constants.Security.BackOfficeExternalAuthenticationType,
                Wreply = $"{adfsRelyingParty}umbraco",
            };

            // Configure BackOffice Account Link button and style
            wsFedOptions.ForUmbracoBackOffice("btn-microsoft", "fa-windows");
            wsFedOptions.Caption = "ADFS Login";

            // Fix Authentication Type
            wsFedOptions.AuthenticationType = adfsFederationServerIdentifier;

            // Configure AutoLinking
            wsFedOptions.SetExternalSignInAutoLinkOptions(
                new ExternalSignInAutoLinkOptions(autoLinkExternalAccount: false,defaultUserGroups:null,defaultCulture:null));

            wsFedOptions.Notifications = new WsFederationAuthenticationNotifications
            {
                SecurityTokenValidated = ClaimsTransformer.GenerateUserIdentityAsync
            };

            wsFedOptions.AuthenticationType = string.Format(CultureInfo.InvariantCulture, adfsFederationServerIdentifier);
            app.UseWsFederationAuthentication(wsFedOptions);
        }

i also tried with the sample project available in http://24days.in/umbraco-cms/2016/authenticating-with-ad-fs-and-identityextensions/ . But Same error i am getting.

I've tried in Umbraco versions 7.7.4 and 7.7.6

Thanks, Sriram

Hello Sriam

I am afraid haven't tested this solution in recent builds. If you have a hybrid setup Azure AD might be an option instead? /Frederik

I've written some instructions on how to use the auto link and how to sync AD groups to Umbraco groups: https://medium.com/@samuel.sperling/authenticating-with-ad-fs-in-umbraco-12d1a4c6777e

Great write up Sam, thanks! Been meaning to update my guide for ages to include groups. This should really be included in the docs. There is an open ticket with my name on it currently. :)

is working on a reply...