ADFS 4.0 - HomeRealmDiscovery only during initial authentication

Ryan McGarry 1 Reputation point
2020-08-01T16:08:58.32+00:00

We have a central ADFS 2016 server, multiple claims providers (all ADFS). All authentication is handled by the other ADFS servers, nothing is done with the local ActiveDirectory claims provider.

Current behavior: Every time a user logs into any application/Relying Party, they are shown the home realm discovery screen. This occurs every time a user accesses a new relying party, even if they still have an active session with the central ADFS server This is frustrating.

Expected behavior: if a user with an active ADFS session clicks a link to a second RP, the user should not be shown Home Realm Discovery again. I would expect the initial HRD selection to persist for the duration of the active session only.

It appears that the HRDCookie could be used, but I would need the HRDCookieLifeTime to be set to less than 1 day - preferably expiring at the end of the user session.

Can this be done with the ADFS configuration, or do I need to break out my Javascript book and start manipulating cookies with a new webtheme?

Any ideas?

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,259 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee
    2020-08-04T00:21:22.14+00:00

    I believe the HRD cookie will be created by ADFS if it is the IDP authenticated the user. In your case it seems that the user is authenticated outside of ADFS.

    If users are always coming from the same IDP, you could customized the relying party trust to redirect directly: 

    Set-AdfsRelyingPartyTrust -TargetName TestApp -ClaimsProviderName @("CustomCP1")

    I think there is an option to configure how the HRD will work between two ADFS servers (configurable with Set-AdfsclaimsProviderTrust). I'll try to find out more about that if the first suggestion isn't a good fit.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.