Resolve Problems Using ADFS with Chrome or Firefox Browsers
If Microsoft Active Directory Federation Services (ADFS) appears to be working with Internet Explorer but problems occur when using Chrome, Firefox, Safari, or other browsers (example: Continuously seeing the ADFS login prompt), the ExtendedProtectionTokenCheck on the ADFS server might need to be disabled.
Disabling this feature lessens security somewhat against man-in-the-middle attacks. If turning off this feature is not acceptable (check with your AD/ADFS administrator), Internet Explorer might be the only browser available.
Note: This feature is disabled only on the ADFS server; Users do not have
to change anything with their browser.
Note: This topic applies to versions of ADFS that are currently supported by Microsoft.
To disable the ExtendedProtectionTokenCheck on the ADFS server:
- Open the Windows PowerShell window (under Administrative Tools).
- Provide the following command: Set-ADFSProperties -ExtendedProtectionTokenCheck None.
- Close the PowerShell window.
- Open the Internet Information Services (IIS) Manager (under Administrative Tools).
- Expand Web Server node (left side), and then expand . Select ls node.
- Double-click Authentication under IIS.
- Right-click Windows Authentication, and then select Advanced Settings.
- Change the selection under Extended Protection to Off.
- Close the IIS Manager.
- Restart both the IIS and ADFS Services.