{"action":"created","issue":{"url":"https://api.github.com/repos/jakubgarfield/Bonobo-Git-Server/issues/368","repository_url":"https://api.github.com/repos/jakubgarfield/Bonobo-Git-Server","labels_url":"https://api.github.com/repos/jakubgarfield/Bonobo-Git-Server/issues/368/labels{/name}","comments_url":"https://api.github.com/repos/jakubgarfield/Bonobo-Git-Server/issues/368/comments","events_url":"https://api.github.com/repos/jakubgarfield/Bonobo-Git-Server/issues/368/events","html_url":"https://github.com/jakubgarfield/Bonobo-Git-Server/issues/368","id":117640500,"number":368,"title":"Federation Auth: Unauthorized","user":{"login":"stupiduglyfool","id":15912104,"avatar_url":"https://avatars.githubusercontent.com/u/15912104?v=3","gravatar_id":"","url":"https://api.github.com/users/stupiduglyfool","html_url":"https://github.com/stupiduglyfool","followers_url":"https://api.github.com/users/stupiduglyfool/followers","following_url":"https://api.github.com/users/stupiduglyfool/following{/other_user}","gists_url":"https://api.github.com/users/stupiduglyfool/gists{/gist_id}","starred_url":"https://api.github.com/users/stupiduglyfool/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stupiduglyfool/subscriptions","organizations_url":"https://api.github.com/users/stupiduglyfool/orgs","repos_url":"https://api.github.com/users/stupiduglyfool/repos","events_url":"https://api.github.com/users/stupiduglyfool/events{/privacy}","received_events_url":"https://api.github.com/users/stupiduglyfool/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/jakubgarfield/Bonobo-Git-Server/labels/is:awaiting-reply","name":"is:awaiting-reply","color":"eb6420"},{"url":"https://api.github.com/repos/jakubgarfield/Bonobo-Git-Server/labels/is:bug","name":"is:bug","color":"e10c02"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-11-18T17:41:29Z","updated_at":"2016-02-23T14:17:41Z","closed_at":null,"body":"Bonobo Version: 5.0.1.0.\r\nIssue: Attempting to login with a federation setup takes me to an unauthorized page.\r\n\r\nDetails:\r\n\r\nI already have an adfs environment setup and working, it is currently operational with other relying parties and works well with for example IdentityServer3.\r\n\r\nI have created a relying party for bonobo, I presume it requires a passive setup, the federation guide does not specify what the Passive URL should be or which adfs profile to use.. these are the values I have used:\r\n\r\nADFS 2.0 Profile\r\nNo token encryption certificate\r\nEnable support for WS-Fed Passive Protocol URL: https://git.fqdn/bonobo.git.server \r\nRelyingPartyIdentifier: urn:bonobo\r\n\r\nI have these values in my web.config:\r\n\r\n```\r\n<add key=\"AuthenticationProvider\" value=\"Federation\" />       \t  \r\n<add key=\"MembershipService\" value=\"ActiveDirectory\" />\r\n<add key=\"ActiveDirectoryDefaultDomain\" value=\"mydomain.co.uk\" />\r\n<add key=\"ActiveDirectoryBackendPath\" value=\"~\\App_Data\\ADBackend\" />\r\n<add key=\"ActiveDirectoryMemberGroupName\" value=\"Developers\" />\r\n<add key=\"ActiveDirectoryTeamMapping\" value=\"Team1=Developers\" />\r\n<add key=\"ActiveDirectoryRoleMapping\" value=\"Administrator=Senior Developers\" />\r\n\t    \r\n<add key=\"FederationMetadataAddress\" value=\"https://adfs.fqdn/federationmetadata/2007-06/federationmetadata.xml\" />\r\n<add key=\"FederationRealm\" value=\"urn:bonobo\" />\r\n```\r\n\r\nWhen I goto https://git.fqdn/bonobo.git.server I am prompted by adfs for my credentials.. which I enter credentials of a user I know to be in the above groups, but unfortunately I get taken to an Unauthorized page. Additionally there doesn't seem to be any useful information in any logs.. but I admit I cannot see any info in the documentation about increasing log levels.\r\n\r\nAny help or guidance would be appreciated."},"comment":{"url":"https://api.github.com/repos/jakubgarfield/Bonobo-Git-Server/issues/comments/187716001","html_url":"https://github.com/jakubgarfield/Bonobo-Git-Server/issues/368#issuecomment-187716001","issue_url":"https://api.github.com/repos/jakubgarfield/Bonobo-Git-Server/issues/368","id":187716001,"user":{"login":"stupiduglyfool","id":15912104,"avatar_url":"https://avatars.githubusercontent.com/u/15912104?v=3","gravatar_id":"","url":"https://api.github.com/users/stupiduglyfool","html_url":"https://github.com/stupiduglyfool","followers_url":"https://api.github.com/users/stupiduglyfool/followers","following_url":"https://api.github.com/users/stupiduglyfool/following{/other_user}","gists_url":"https://api.github.com/users/stupiduglyfool/gists{/gist_id}","starred_url":"https://api.github.com/users/stupiduglyfool/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stupiduglyfool/subscriptions","organizations_url":"https://api.github.com/users/stupiduglyfool/orgs","repos_url":"https://api.github.com/users/stupiduglyfool/repos","events_url":"https://api.github.com/users/stupiduglyfool/events{/privacy}","received_events_url":"https://api.github.com/users/stupiduglyfool/received_events","type":"User","site_admin":false},"created_at":"2016-02-23T14:17:41Z","updated_at":"2016-02-23T14:17:41Z","body":"I now have it working with the latest git code, without making any sourcecode changes, the recent changes you have made to the adfs, team and accounts pages seem to have cleared up any problems.\r\n\r\nHowever I do have some guidance here for your documentation..\r\n\r\nFollowing these:\r\n\r\n[How to convert objectguid](http://nzpcmad.blogspot.co.uk/2013/01/adfs-objectguid-as-claim.html)\r\n[How to setup a string transformation rule](https://jorgequestforknowledge.wordpress.com/category/active-directory-federation-services-adfs/transform-rules/)\r\n[String processing in adfs claims](https://msdn.microsoft.com/en-us/library/hh599320.aspx)\r\n[How to install custom stores](https://msdn.microsoft.com/en-us/library/ee895358.aspx)\r\n\r\nFollowing the above links I've managed to develope and configure a solution to allow me to configure a adfs relying party to automatically convert the ObjectGuid to a guid and send it back as UPN, this way I don't need to make any code changes in bonobo.. although maybe in the future you want to use the PPID claim type instead of UPN.\r\n\r\nI've attached the code I used to produce the adfs claims rule, I also included the compiled dll, the last link above contains guidance on how to install it:\r\n[AdfsStringProcessing.zip](https://github.com/jakubgarfield/Bonobo-Git-Server/files/142678/AdfsStringProcessing.zip)\r\n\r\nFinally, I discovered with the latest code you require more claims to be configured in adfs, so I've got a screenshot of my full adfs setup here:\r\n\r\n![screeny](https://cloud.githubusercontent.com/assets/15912104/13253995/20d44f18-da37-11e5-9682-26bf80965437.png)\r\n"}}