{"id":3065,"date":"2014-11-17T08:43:21","date_gmt":"2014-11-17T16:43:21","guid":{"rendered":"http:\/\/www.cloudidentity.com\/blog\/?p=3065"},"modified":"2014-11-17T08:43:22","modified_gmt":"2014-11-17T16:43:22","slug":"skipping-the-home-realm-discovery-page-in-azure-ad","status":"publish","type":"post","link":"https:\/\/www.cloudidentity.com\/blog\/2014\/11\/17\/skipping-the-home-realm-discovery-page-in-azure-ad\/","title":{"rendered":"Skipping the Home Realm Discovery Page in Azure AD"},"content":{"rendered":"<p>A typical authentication transaction with Azure AD will open with a&nbsp; generic credential gathering page. As the user enters his\/her username, Azure AD figures out from the domain portion of the username if the actual credential gathering should take place elsewhere (for example, if the domain is associated with a federated tenant the actual cred gathering will happen on the associated ADFS pages) and if it\u2019s the case it will redirect accordingly.<\/p>\n<p>Sometimes your app logic is such that you know in advance whether such transfer should happen. In those situations you have the opportunity to let our libraries (ADAL or the OWIN middlewares for OpenId Connect\/WS-Federation) know where to go right from the start.<\/p>\n<p>In OAuth2 and OpenId Connect you do so by passing the target domain in the \u201cdomain_hint\u201d parameter. <br \/>In ADAL you can pass it via the following:<\/p>\n<pre class=\"csharpcode\">AuthenticationResult ar =\n    ac.AcquireToken(<span class=\"str\">\"https:\/\/developertenant.onmicrosoft.com\/WebUXplusAPI\"<\/span>,\n                    <span class=\"str\">\"71aefb3b-9218-4dea-91f2-8b23ce93f387\"<\/span>,\n                    <span class=\"kwrd\">new<\/span> Uri(<span class=\"str\">\"http:\/\/any\"<\/span>), PromptBehavior.Always, <\/pre>\n<pre class=\"csharpcode\">                    UserIdentifier.AnyUser, <span class=\"str\"><font style=\"background-color: #ffff00\">\"domain_hint=mydomain.com\"<\/font><\/span>);\n<\/pre>\n<style type=\"text\/css\">.csharpcode, .csharpcode pre\n{\n\tfont-size: small;\n\tcolor: black;\n\tfont-family: consolas, \"Courier New\", courier, monospace;\n\tbackground-color: #ffffff;\n\t\/*white-space: pre;*\/\n}\n.csharpcode pre { margin: 0em; }\n.csharpcode .rem { color: #008000; }\n.csharpcode .kwrd { color: #0000ff; }\n.csharpcode .str { color: #006080; }\n.csharpcode .op { color: #0000c0; }\n.csharpcode .preproc { color: #cc6633; }\n.csharpcode .asp { background-color: #ffff00; }\n.csharpcode .html { color: #800000; }\n.csharpcode .attr { color: #ff0000; }\n.csharpcode .alt \n{\n\tbackground-color: #f4f4f4;\n\twidth: 100%;\n\tmargin: 0em;\n}\n.csharpcode .lnum { color: #606060; }\n<\/style>\n<p>&nbsp;<\/p>\n<p>In the OWIN middleware for OpenId Connect you can do the same in the RedirectToIdentityProvider notification:<\/p>\n<pre class=\"csharpcode\">app.UseOpenIdConnectAuthentication(\n    <span class=\"kwrd\">new<\/span> OpenIdConnectAuthenticationOptions\n    {\n        ClientId = clientId,\n        Authority = authority,\n        PostLogoutRedirectUri = postLogoutRedirectUri,\n        Notifications = <span class=\"kwrd\">new<\/span> OpenIdConnectAuthenticationNotifications()\n        {\n            RedirectToIdentityProvider = (context) =&gt; \n            {                                                        \n                <font style=\"background-color: #ffff00\">context.ProtocolMessage.DomainHint = <span class=\"str\">\"mydomain.com\"<\/span><\/font>; \n                <span class=\"kwrd\">return<\/span> Task.FromResult(0); \n            }, \n        }\n    });\n<\/pre>\n<style type=\"text\/css\">.csharpcode, .csharpcode pre\n{\n\tfont-size: small;\n\tcolor: black;\n\tfont-family: consolas, \"Courier New\", courier, monospace;\n\tbackground-color: #ffffff;\n\t\/*white-space: pre;*\/\n}\n.csharpcode pre { margin: 0em; }\n.csharpcode .rem { color: #008000; }\n.csharpcode .kwrd { color: #0000ff; }\n.csharpcode .str { color: #006080; }\n.csharpcode .op { color: #0000c0; }\n.csharpcode .preproc { color: #cc6633; }\n.csharpcode .asp { background-color: #ffff00; }\n.csharpcode .html { color: #800000; }\n.csharpcode .attr { color: #ff0000; }\n.csharpcode .alt \n{\n\tbackground-color: #f4f4f4;\n\twidth: 100%;\n\tmargin: 0em;\n}\n.csharpcode .lnum { color: #606060; }\n<\/style>\n<p>&nbsp;<\/p>\n<p>Finally, in WS-Fed you do the following:<\/p>\n<pre class=\"csharpcode\">app.UseWsFederationAuthentication(\n   <span class=\"kwrd\">new<\/span> WsFederationAuthenticationOptions\n   {\n      Notifications = <span class=\"kwrd\">new<\/span> WsFederationAuthenticationNotifications\n      {\n         RedirectToIdentityProvider = (context) =&gt;\n         {\n            <font style=\"background-color: #ffff00\">context<\/font><font style=\"background-color: #ffff00\">.ProtocolMessage.Whr = <span class=\"str\">\"mydomain.com\"<\/span>;\n<\/font>            <span class=\"kwrd\">return<\/span> Task.FromResult(0);\n         }\n      }\n   }\n}<\/pre>\n<style type=\"text\/css\">.csharpcode, .csharpcode pre\n{\n\tfont-size: small;\n\tcolor: black;\n\tfont-family: consolas, \"Courier New\", courier, monospace;\n\tbackground-color: #ffffff;\n\t\/*white-space: pre;*\/\n}\n.csharpcode pre { margin: 0em; }\n.csharpcode .rem { color: #008000; }\n.csharpcode .kwrd { color: #0000ff; }\n.csharpcode .str { color: #006080; }\n.csharpcode .op { color: #0000c0; }\n.csharpcode .preproc { color: #cc6633; }\n.csharpcode .asp { background-color: #ffff00; }\n.csharpcode .html { color: #800000; }\n.csharpcode .attr { color: #ff0000; }\n.csharpcode .alt \n{\n\tbackground-color: #f4f4f4;\n\twidth: 100%;\n\tmargin: 0em;\n}\n.csharpcode .lnum { color: #606060; }\n<\/style>\n<p>Party on! <img decoding=\"async\" class=\"wlEmoticon wlEmoticon-smile\" style=\"border-top-style: none; border-bottom-style: none; border-right-style: none; border-left-style: none\" alt=\"Smile\" src=\"https:\/\/www.cloudidentity.com\/blog\/wp-content\/uploads\/2014\/11\/wlEmoticon-smile.png\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A typical authentication transaction with Azure AD will open with a&nbsp; generic credential gathering page. As the user enters his\/her username, Azure AD figures out from the domain portion of the username if the actual credential gathering should take place elsewhere (for example, if the domain is associated with a federated tenant the&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-3065","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/posts\/3065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/comments?post=3065"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/posts\/3065\/revisions"}],"predecessor-version":[{"id":3066,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/posts\/3065\/revisions\/3066"}],"wp:attachment":[{"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/media?parent=3065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/categories?post=3065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudidentity.com\/blog\/wp-json\/wp\/v2\/tags?post=3065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}