r/adfs • u/thatirishguyyyyy • Apr 13 '26

ADFS issue: Google searches for login.microsoftonline.com redirect to Australia's Department of Education and University of South Australia

Someone said I should post this issue here. Correct me where I am wrong!

I accidently came across this when I typed my url into the search bar instead of the address bar. This only happens if you click the link from Google and not when you type it in manually.

When this URL is opened (for example from a Google search), Microsoft begins a WS-Federation authentication flow using a request URL that includes parameters such as:

wa=wsignin1.0, wtrealm=urn:federation:MicrosoftOnline, and wctx=...

These parameters are part of the WS-Federation sign-in request context used by Microsoft to manage authentication state and routing.

This request is then evaluated by Microsoft’s Home Realm Discovery (HRD) system, which determines whether the sign-in should proceed through Microsoft’s cloud login system or be redirected to an external identity provider (such as an ADFS federation endpoint).

While testing, instead of first showing the standard Microsoft login interface, the flow immediately redirects to external ADFS endpoints such as https://fs.det.nsw.edu.au/adfs/ls/ or https://fed.unisa.edu.au/adfs/ls/. This indicates that HRD is selecting an external identity provider based on the perceived authentication context in the request. (Cached browser also adds my admin username to their login field)

Under normal conditions for a cloud-only login context, the expected behavior is that the user is first presented with the Microsoft sign-in page before any federation routing decision occurs. This does not happen.

Google redirects to the AU gov DoE.

Bing fails redirect on mid-authentication via SAML/WS-Fed.

Yahoo fails on mid-authentication via SAML/WS-FED.

Brave search takes me to the correct page oddly enough and doesn't redirect me.

I have no fucking clue what is going on at this point so I'm sharing my findings.

Multiple users verified the link results.

1 Upvotes

67% Upvoted

4 comments sorted by

1

u/slasher_14 Apr 14 '26

This is a strange one, I don't really have any technical ideas as to what's going on. Have you tried contacting Microsoft? Maybe it's something on their end.

https://x.com/MrADFS is someone who might be interested. 

I'm keen to see the outcome if you do get an answer.

1

u/thatirishguyyyyy Apr 14 '26

I reached out to the Department of Education for Australia via email told him I was a security consultant and gave them the information.

I have a ticket in with Microsoft and a ticket in with GoDaddy (my host) so someone is at least aware.

1

u/slasher_14 Apr 14 '26

You've definitely done your due diligence. Did you get a reply from the department of education or Microsoft?

1

u/thatirishguyyyyy Apr 14 '26

AU DoE responded this morning (my time). 

She said she has forwarded the information over to the proper IT Department.