SharePoint Claims Auth Without SSL

Someone asked me the other day whether we could use claims auth in SharePoint 2010 with ADFS v2 as the identity provider STS (STS-IP), but NOT use SSL on the SharePoint site.  In working through it, I found that there are some inherent limitations in making this happen, but not on the SharePoint side.  In ADFS when you define the relying party (SharePoint 2010 in this case), you have to define a WS-Fed endpoint.  When you do that, ADFS requires that the endpoint be SSL secured.  The endpoint when SharePoint 2010 is the relying part is protocol://siteUrl/_trust/.  In this case, since ADFS requires SSL for the WS-Fed endpoint, the protocol portion of the Url must be SSL.

So the short answer is, to use claims auth in SharePoint with ADFS, you must use SSL.  Other STS-IP implementations may not have this requirement, but ADFS v2 does.

Comments (6)

  1. alexandrad9x says:

  2. Sreekantha Gujjar says:

    I am facing the same issue with Live ID STS as well. This is itself a serious limitation to force SSL for claims whether it is problem with SharePoint or IP-STS. Hope this gets resolved soon, so claims authentication can be used on non SSL

  3. Eric Raff says:

    Do you see any issues where you have your SP 2010 WFE boxes behind a hardware load balancer and the HLB is taking care of the SSL but the connection from the HLB to the WFE is over port 80?

    Hence when you define the WS-Fed endpoint it would be https://siteUrl/_trust where the siteUrl is pointed to the HLB.



  4. zubair says:

    @Eric we have implemented this aswell where the VIP port 80 and 443 both point to a single sharepoint port and with a bit of alternate access mapping this works fine for now. But i would be interested to know if this is a valid solution from a Microsoft rep. What we found though is even if you started on port 443 after redirection you ended up in port 80 however after authentication u can still go to port 443 and things would show fine

  5. SDF says:

Skip to main content