title: Custom authentication adapter in ADFS as a primary step
body: <p>We have a setup which involves a third party web application using <a href="https://msdn.microsoft.com/en-us/library/bb897402.aspx" rel="nofollow noreferrer">ADFS</a> as its access control server. That worked well for a while.</p>
  
  <p>Now we need to install a custom Authentication Policy in <code>ADFS</code>, in order to delegate the authentication process to yet another custom, in-house built server and employ custom, dynamic rules.</p>
  
  <p>From our understanding, this is a bird's eye view of the general ADFS authentication pipeline:</p>
  
  <p><a href="https://i.stack.imgur.com/zOYLf.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/zOYLf.png" alt="enter image description here"></a></p>
  
  <p>Basically, it's quite easy to augment the authentication process with a custom, secondary step but it's impossible to skip the <code>Primary</code> authentication sub process.</p>
  
  <p>We did manage to implement a <code>Multi Factor Authentication Adapter</code> (basically a .NET assembly which subscribes to the <code>ADFS</code> conventions) and successfully install it within our <code>ADFS</code>:
  <a href="https://i.stack.imgur.com/zv1bh.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/zv1bh.png" alt="enter image description here"></a></p>
  
  <p>Unfortunately, our situation requires us to customize the very first step and react differently to various scenarios. For instance:</p>
  
  <ul>
  <li><em>maybe</em> host a custom login form which validates credentials with the <code>AD</code></li>
  <li><em>maybe</em> react to a custom-built, non <code>ADFS</code> <code>OAuth</code> access token</li>
  <li>etc</li>
  </ul>
  
  <p>Having the end user be forced to provide credentials from the get go is a deal breaker.</p>
  
  <p>Does anyone have an idea about how this could be achieved?</p>
  
  <p>We're using <code>ADFS</code> on <code>Windows Server 2012 R2</code>. This version of <code>ADFS</code> doesn't require <code>IIS</code> to be preinstalled.</p>
  
  <p>We found an interesting article regarding <code>ADFS 2.0</code> which is much older than what we're using and requires <code>IIS</code>. The article provides an example of how to alter the sign in page of what seems to be the primary authentication step:</p>
  
  <p><a href="https://social.technet.microsoft.com/wiki/contents/articles/1600.ad-fs-2-0-how-to-change-the-local-authentication-type.aspx" rel="nofollow noreferrer">https://social.technet.microsoft.com/wiki/contents/articles/1600.ad-fs-2-0-how-to-change-the-local-authentication-type.aspx</a></p>
  
  <p>We didn't manage to replicate that example on our <code>ADFS</code>.</p>