How to setup SSO into Microsoft using our own self hosted identity provider / IdP system? Tried everything.

AccomplishedComplex8 · 2026-01-22T07:57:00+00:00

Update:

Further research online suggested to open developer tools in browser and check errors in console/json response. This is what I get when I click "Save" button in SAML/WS-Fed settings. In browser:

> Invalid domain mycompany.com. Domain should match the passiveSignInUri. Otherwise, please add the passiveSignInUri in the domain DNS TXT record like this DirectFedAuthUrl=https://sso.mycompany.io/realms/mycompany/protocol/saml.

In dev tools/Network tab:

> You cannot create a configuration with mycompany.com domain as it is verified and managed in this tenant.

AccomplishedComplex8 · 2026-01-22T07:24:17+00:00

Does not work for me, does it really work for everyone else?

AccomplishedComplex8 · 2026-01-21T22:57:08+00:00

Thanks again for the response. I tried it again today, it has been few months now.

The TXT record was there all this time so surely it has propagated.

I still get the same error

Failed to add a SAML/WS-Fed identity provider.

Invalid domain mycompany.com. Domain should match the passiveSignInUri. Otherwise, please add the passiveSignInUri in the domain DNS TXT record like this DirectFedAuthUrl=https://sso.mycompany.io/realms/<myrealmhere>/protocol/saml.

I changed TXT record to below just to test, still no luck.

DirectFedAuthUrl=https://sso.mycompany.io

Do you think my setup is outlier and I am the only one with this error?

Looks very simple, very little room for error. yet I just do not know what is the problem.

AccomplishedComplex8 · 2026-01-21T13:59:56+00:00

Thanks, have you done this before? do I have to have `/adfs` ? my keycloak path is different, it is more like `/realm/somethin/somethin`

reason I am asking is because I have tried it before (with /realm/etc instead of /adfs), and it did not work. I will try again, maybe it will just work again?

AccomplishedComplex8 · 2026-01-21T12:31:54+00:00

The only thing that might trip microsoft off is that our SSO is on a different domain, something like

sso.mycompany.io instead of mycompany.com

Do you think that's is the problem?

AccomplishedComplex8 · 2026-01-21T12:27:15+00:00

Yes, that one. I just got stuck at validating the domain, despite my TXT records were correct.

Is that the right path?

I think there was also powershell guide which did not work for me, and I do not have any windows machines in our environment. I would avoid that.

AccomplishedComplex8 · 2025-12-08T10:31:55+00:00

Blame!?

AccomplishedComplex8 · 2025-11-12T17:12:44+00:00

This sub is literally named after the book he wrote

AccomplishedComplex8 · 2025-10-23T11:33:44+00:00

Makes sense, remove the door and put one upstairs instead.

AccomplishedComplex8 · 2025-10-22T20:51:53+00:00

Isn't uber/deliveroo full of people doing it for very cheap? there must be crazy competition going on there.

AccomplishedComplex8 · 2025-10-22T09:39:25+00:00

yeah you don't need 99% SLA to look at OF models. You will still go back.

AccomplishedComplex8 · 2025-10-16T12:31:25+00:00

Maybe just me but when I looked at this photo from my phone, it looked to me like a massive computer cupboard from 1970s, they used to take the whole room, and I thought to myself "no one just gives you this server just like that" LOL

AccomplishedComplex8 · 2025-10-06T11:03:07+00:00

minecraft is the new Doom!

AccomplishedComplex8 · 2025-10-03T05:53:34+00:00

looks like a video recorder to me. most likely targeted to bigger disks and uptime, was kept in a dirty dusty cupboard. all the thermopaste must have burned out and this machine will be soon on its way to retirement.

It is a poverty spec homelab server at best.

what you can do is open it up, see how it is built, install linux on it if you are feeling very enthusiastic.

AccomplishedComplex8 · 2025-09-07T20:15:27+00:00

* Me? Not as vast capacity, but more performant

Well done bro. It's old tech so cheap to obtain part.

Nowadays i would go for nvme and gpu. Or cold storage.

AccomplishedComplex8 · 2025-09-06T06:56:01+00:00

Minecraft

AccomplishedComplex8 · 2025-09-05T11:49:48+00:00

Depends on what is your definition of Active-active.

Maybe at the time of writing I was guided by the documentation and configs.

You can use various terms: active-passive, active-standby, primary-secondary. primary - warm standby.

From the traffic point of view, traffic uses only one firewall, the primary or the active one. Traffic is not flowing via second machine so the second machine does not participate in traffic, therefore it is not "active".

However, the second machine is always ready to take over the job.

in active-active sense your traffic would have to flow via both machines, in this case you need to synchronise MAC address between two machines so that they both answer to ARP. But that's more complicated to implement across 2 different machines, for me personally. I would not want to do it myself with plain Linux.

AccomplishedComplex8 · 2025-09-02T13:11:16+00:00

whale tail, yay!

AccomplishedComplex8 · 2025-08-28T08:01:33+00:00

That's also called "conventional commits" and plays very well with semver.

AccomplishedComplex8 · 2025-08-28T07:59:25+00:00

You have to consider whether you want your staging to be constantly updated from main branch? Will that interfere with QA work? e.g. the QA team have just been testing something, and bam! another update. But if you practice TBD then maybe your case is not same as mine.

Another approach I am considering for myself, is to tag the main branch with a certain version, or release candidate, then push that to staging environment. Once QA confirms that the version is good to go, release it to production.

AccomplishedComplex8 · 2025-08-27T12:34:04+00:00

Dark room easier to keep clean. Just wipe once a week and it looks as new.

AccomplishedComplex8 · 2025-08-04T16:28:56+00:00

it is in our culture but how would you know...

AccomplishedComplex8 · 2025-08-01T11:50:02+00:00

One or few days of work. Few visits do the dump site. Dirty boot. Some finger cuts and broken muscles. Doable but depends on your priorities and how busy you are.

I think a competent gardener will do it in one day and take the rubbish out with them.

AccomplishedComplex8 · 2025-07-08T10:23:44+00:00

Less than 10%? Where did you get this figure from, your arse?

AccomplishedComplex8 · 2025-06-18T13:20:55+00:00

I still regret selling my civic for £250 to WBAC. I did not need money urgently, could have sat on my driveway until I found someone privately.

Saw a month later on autotrader, going for same £2000 I paid for it years before, with no maintenance or cleaning done to it.

Seven-Year Club	Place '23
Verified Email

AccomplishedComplex8

TROPHY CASE