Web Application Proxy (WAP) AD FS Authentication Redirect Loop

Question

Web Application Proxy (WAP) AD FS Authentication Redirect Loop

Adrian Tan 80

Hi all,

Users accessing published web applications through WAP are repeatedly sent back to the AD FS sign-in page instead of being redirected to the requested resource. What is the correct way to align the OAuth relying party trust identifiers between WAP and AD FS to prevent the authentication loop?

Thanks

0 comments

1 answer

Your answer

Answer 1

Hello,

The repeated redirect back to the AD FS sign‑in page through Web Application Proxy is almost always caused by a mismatch between the identifiers configured in the AD FS relying party trust and the identifiers that WAP uses when publishing the application. OAuth and OpenID Connect rely on exact string matching of the client_id and redirect_uri values, so if WAP is configured with a relying party identifier that does not match what AD FS expects, the token issuance fails and the user is sent back into the authentication loop.

To correct this, open the AD FS Management console on the federation server and locate the relying party trust for the published application. Under the “Identifiers” tab, confirm that the relying party identifier (for example https://app.contoso.com/) exactly matches the identifier configured in the WAP publishing rule. If you are using OAuth, also check the Redirect URIs defined in the application properties in AD FS, ensuring they match the external URL that WAP presents to the client. Any discrepancy, even in trailing slashes or case sensitivity, will cause AD FS to reject the request.

On the WAP server, use the Remote Access Management console or PowerShell (Get-WebApplicationProxyApplication) to review the ExternalUrl and BackendServerUrl. The ExternalUrl must correspond to the identifier registered in AD FS. If you find a mismatch, update the WAP application with Set-WebApplicationProxyApplication so that the identifiers align.

After making the changes, restart the AD FS service (net stop adfssrv && net start adfssrv) and recycle the WAP service (net stop wapservice && net start wapservice). Then test a login flow and check the AD FS Admin log under Applications and Services Logs > AD FS > Admin for Event ID 1000/1001 to confirm that the token issuance succeeds.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.