When you try to set up Active Directory Federation Services (AD FS) in a "firewall-published" configuration, non-browser clients can't authenticate by using a federated user account. However, a client computer that resides on the on-premises network can successfully authenticate to a Microsoft cloud service such as Office 365, Microsoft Azure, or Microsoft Intune by using a federated user account.
The firewall-published configuration uses a firewall device, such as Microsoft Threat Management Gateway (TMG), to reverse proxy the AD FS Federation Service directly to the Internet. For more information about how to configure AD FS in a firewall-published configuration, see the following Microsoft Knowledge Base article:
2510193 Supported scenarios for using AD FS to set up single sign-on in Office 365, Azure, or Intune
Additionally, when the non-browser client tries to authenticate to the on-premises AD FS Federation service endpoint name, such as https://sts.contoso.com/adfs/ls/, one or more of the following issues occurs:
You're repeatedly prompted to log on (more than three times) without a successful authentication.
Access is denied, even though you enter valid Active Directory credentials.
"403 page not found" errors occur.
This issue occurs when the service requirements for publishing AD FS through a firewall limit a client device’s HTTP access to the AD FS Federation service. In this case, one or more of the following conditions are true:
Extended Protection for Authentication (EPA) may not be disabled on the AD FS Federation Server farm.
Firewall reverse proxy rule features may have been enabled that disrupt normal AD FS connection and functionality.
Disable Extended Protection Authentication for AD FS
Extended Protection Authentication (EPA) is a feature that's used by AD FS to detect man-in-the middle attacks. When a firewall is proxying the connection to the AD FS server, EPA may identify the firewall proxy as an attack. For information about how to disable this feature, see the following Microsoft Knowledge Base article:
2461628 A federated user is repeatedly prompted for credentials during sign-in to Office 365, Azure, or Intune
Firewall proxy rule configuration may be limiting connectivity
Note The following information is only advisory and may help resolve the problem, but it's offered without guarantee:
Firewall proxy rule configuration may be limiting connectivity.
Three specific firewall rule features will corrupt AD FS server traffic en-route. For the reverse proxy rule allowing access to AD FS from the Internet, disable the following features:
Microsoft Azure cloud services, Microsoft Azure Active Directory, Microsoft Office 365, Microsoft Intune, CRM Online via Office 365 E Plans, Microsoft Azure Recovery Services, Office 365 Identity Management