WS-Fed Application Integrations

WS-Fed (WS-Federation) Application Integration is a way to enable Single Sign-On (SSO) between an Identity Provider (IdP) and an application using the WS-Federation protocol.

---

Web Services Federation (WS-Federation or WS-Fed) is an identity protocol that allows a Security Token Service (STS) in one trust domain to provide authentication information to a STS in another trust domain when there is a trust relationship between the two domains.

It is part of the larger WS-Security framework and an extension to the functionality of WS-Trust. WS-Fed features can be used directly by Simple Object Access Protocol (SOAP) applications and web services. This protocol that can be used to negotiate the issuance of a token. WS-Fed protocol supports both active and passive clients.

WS-Federation works in much the same way as SAML 2.0 and OpenID Connect. With WS-Federation, the requesting application is known as the Relying Party (RP) and the central service is known as the Security Token Service (STS).

WS-Fed Integration

Our current SAML integration has been extended to support WS-Fed protocol.

WS-Fed Configuration with Azure

• AdminX Side
• Azure Side

AdminX Side

1. Navigate to your AdminX tenant.
2. Click the Applications icon on the left-hand menu.
3. Go to Add Application > SAML 2.0 Generic > Add Integration > Add Application.
4. Enter Basic Settings to create new SAML application:

   • Application Name: ws-fed
   • Instance: Production
   • Application access URL: https://login.microsoftonline.com/login.srf
5. Click Next.
6. Enter Advanced Options.

   • Entity ID: urn:federation:MicrosoftOnline
   • Assertion Consumer Service

     • Method: POST
     • URL: https://login.microsoftonline.com/login.srf
   • Signing Algorithm: RSA-SHA256
7. Click Save.
8. Enter Assertion Statement (NameID). NameID should be mapped to an attribute which contains Azure user email.

   • Format: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
   • Value: lastname
   • Add claim with name http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID. Value should carry Azure user immutableID. This claim is required. All the other attributes and parameters are optional.
9. Click Next.

Azure Side

Federate a Microsoft Entra ID custom domain with 1Kosmos as the SAML identity provider using the Microsoft Graph PowerShell SDK.

The legacy MSOnline and AzureAD PowerShell modules are deprecated. This section uses the current Microsoft Graph PowerShell SDK.

Prerequisites

• Global Administrator permissions in Microsoft Entra ID
• A verified custom domain in Microsoft Entra ID
• 1Kosmos BlockID SAML configuration details (see below)

Required Information from 1Kosmos

1Kosmos Platform details
- Issuer URI:          [Entity ID from your community] 
- SSO URL:             [SSO URL from your community]
- SLO URL:             [SLO URL from your community]
- Signing Certificate: [Base64 encoded certificate]

Step 1: Launch the Microsoft Graph PowerShell

1.1. Log in to portal.azure.com.

1.2 In the header, click (Cloud Shell icon). A Cloud Shell toolbar appears as shown below; Select PowerShell.

1.3. Once PowerShell is launched, run the command below.

Install-Module Microsoft.Graph -Scope CurrentUser

Step 2: Connect to Microsoft Graph

Connect with the permissions required to manage domains.

Connect-MgGraph -Scopes "Domain.ReadWrite.All", "Directory.ReadWrite.All"

Step 3: Verify Domain Status

Confirm the domain's current authentication type is Managed before you federate it.

Get-MgDomain -DomainId "EntraID domain name"

Step 4: Configure Domain Federation

Define the federation parameters, then apply them.

$federationParams = @{
    DomainId                        = "EntraID domain name"
    DisplayName                     = "1Kosmos"
    IssuerUri                       = "urn:entityID" 
    metadataexchangeuri             = "[tenantdns/communityname/services/trust/mex]"      
    PassiveSignInUri                = "[tenantdns/adminapi/communityname/wsfed]"
    SignOutUri                      = "[tenantdns/adminapi/communityname/slo]"
    SigningCertificate              = "[Base64 encoded certificate]"
    PreferredAuthenticationProtocol = "wsFed"
    FederatedIdpMfaBehavior         = "acceptIfMfaDoneByFederatedIdp"
}

New-MgDomainFederationConfiguration @federationParams

Step 5: Verify Federation

Confirm the domain is now federated and review the applied configuration.

# Domain should now show AuthenticationType: "Federated"
Get-MgDomain -DomainId "EntraID domain name"

# Review the federation configuration details
Get-MgDomainFederationConfiguration -DomainId "EntraID domain name"

Step 6: Test Federation

1. Navigate to https://login.microsoftonline.com.
2. Enter any user with the Entra ID domain name.

The sign-in should redirect to 1Kosmos authentication.

Revert Federation (if needed)

Roll the domain back to a managed (cloud-only) configuration.

# Get the federation configuration
$federationConfig = Get-MgDomainFederationConfiguration -DomainId "EntraID domain name"

# Remove the federation
Remove-MgDomainFederationConfiguration -DomainId "EntraID domain name" -InternalDomainFederationId $federationConfig.Id

# Domain should return to AuthenticationType: "Managed"
Get-MgDomain -DomainId "EntraID domain name"

Initiate Login

The steps to initiate login:

1. Navigate to the Azure portal login page.
2. Enter the user email from the federated domain.
3. The user should be redirected to the 1Kosmos login page.
4. Enter a valid user's credentials.
5. After the user is authenticated in 1Kosmos, the user will be redirected back to Azure and will be logged into the Azure portal.