SSO on Expressway with ADFS

[Bill]

I am trying to configure SSO on Expressway-C (version X15.0.2) using ADFS on Server 2019.
I am following this guide.
https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/expressway/config_guide/X15-0/mra/exwy_b_mra-deployment-guide-x150.pdf

I am having trouble at the section where it says to do this:
Set-ADFSRelyingPartyTrust -TargetName "<Name>" -SAMLResponseSignature MessageAndAssertion
where <Name> must be a display name for the Relying Party Trust of Expressway-E as set in ADFS.

In the XML file exported from Exp-C, I see the Exp-E name in there.
But I cannot get ADFS to accept the command.
It returns this: PS0132: No RelyingPartyTrust found with name 'exp14-e.mydomain.com'.

Next, Instead of the Exp-E name, I used the entityID of the Trust.
I get a different error:  Set-AdfsRelyingPartyTrust : A parameter cannot be found that matches parameter name
'SAMLResponseSignatureMessageAndAssertion'.

[Roger Kallberg]

As per the section in the referenced document it’s the name of the Relaying Party Trust that you’ve created in ADFS that you should use in the mentioned command.

 

Depending upon what you named these in ADFS the command will vary. What names have you used for these in ADFS?

[Bill]

Thank you for the reply, Roger.

That's what I thought, and I tried that in the second command I showed.
And I get this response:
Set-AdfsRelyingPartyTrust : A parameter cannot be found that matches parameter name
'SAMLResponseSignatureMessageAndAssertion'.

Looks like a syntax error on my part.
I Copy and Pasted the command, and was entering the parameter as: -SAMLResponseSignatureMessageAndAssertion
But I believe it should have a space, like this: -SAMLResponseSignature MessageAndAssertion

I entered it with the space, and it accepted the command.

However it is not working.
In the Exp-C Event Log, I am seeing this:

edgeconfigprovisioning: Level="INFO" Event="Edge SSO" Service="OAuth/SSO" Detail="Redirected client to IdP" Dst-ip="127.0.0.1" Dst-port="32126" Idp="http://DC1a.mydomain.com/adfs/services/trust" Local-ip="127.0.0.1" Local-port="22111" Trackingid="152e5410-fefb-49d1-9ec1-2de93d5feae5" Username="user1" UTCTime="2024-07-23 13:16:46,159"

What looks odd is the DST-IP=127.0.0.1
I would expect it to be the IP of the ADFS server.
But I am not 100% sure.

I did take a packet capture from the Exp-C.
It never tries to talk to the ADFS server.

It can resolve it by name.

Still testing.

Thanks