LiveID SharePoint 2010 Integration

Question

I'm trying to configure the LiveId integration with SharePoint 2010. MS Service Manager Settings:

Domain name: domain.com

DNS: urn:subdomain-dev:int

Default Return URL: https://subdomain-dev.domain.com/SitePages/Home.aspx

I've imported X509 certificate. After that I use following PowerShell Script to create TrustedIdentityTokenIssuer:

asnp microsoft.sharepoint.powershell
$realm = "urn:subdomain-dev:int"
$certfile = "C:\LiveID-INT.cer"
$rootcert = Get-PfxCertificate $certfile
New-SPTrustedRootAuthority "Live ID INT Root Authority" -Certificate $rootcert
$emailclaim = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/claims/EmailAddress" -IncomingClaimTypeDisplayName "http://schemas.xmlsoap.org/claims/EmailAddress" -SameAsIncoming
$upnclaim =  New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" -IncomingClaimTypeDisplayName "UPN" -LocalClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"
$authp = New-SPTrustedIdentityTokenIssuer -Name "LiveID INT" -Description "LiveID INT" -Realm $realm -ImportTrustCertificate $certfile -ClaimsMappings $emailclaim,$upnclaim -SignInUrl "https://login.live-int.com/login.srf" -IdentifierClaim "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"

Problem: After creating the web application specifying in host subdomain-dev.domain.com creating SiteCollection and trying access it I receive the 500 Error in web browser. ULS logs shows Security Exception :

System.IdentityModel.Tokens.SecurityTokenException: The issuer of the token is not a trusted issuer.

I assume that it was not correctly mapped to the realm (or DNS). How should I specify my domain and DNS in Service Manager. Or any other ideas?

Answer 1

Make sure that the Web App you are configuring to use the Live ID provider has the exact Domain Name as the URL of your Web App.

In you example you have specified domain.com com in the wicked MSM application but use XXX.domain.com for your Web App. Either change your web app or the MSM registration.

Answer 2

I don´t have any good answer to your problem, but I can give you a tip of checking out my collegue MVP Wictor Wiléns great blog post about LiveID configuration divided in three series and see if you can get any ideas from that.

Part 1 - http://www.wictorwilen.se/Post/Visual-guide-to-Windows-Live-ID-authentication-with-SharePoint-2010-part-1.aspx

Part 2 - http://www.wictorwilen.se/Post/Visual-guide-to-Windows-Live-ID-authentication-with-SharePoint-2010-part-2.aspx

Part 3 - http://www.wictorwilen.se/Post/Visual-guide-to-Windows-Live-ID-authentication-with-SharePoint-2010-part-3.aspx

Regards Johan

Answer 3

I would stop and use Azure ACS instead.

Answer 4

There is also an article on nothingbutsharepoint.com from Jeremy Thake on how that site was LiveID enabled. It might give you some other pointers to look at. It seems he took a lot of help from Wictor too.

Answer 5

Not to sign him up to help you, but Jeremy Thake did this for nothingbutsharepoint.com. I'm sure if you reach out to him on Twitter (@jthake) he would give you a little guidance.

Answer 6

You have imported the certificate as mentioned. I've not yet configured a live id auth site, but could you check the certificate chain? is it a self signed? If not try to import the issuing root certificate to the trusted root authority (on the sharepoint box -> open a fresh mmc and add the certificate snap in for the computer account). Add the root certificate here. if this is not enough, than add the certificate of the root ca to the sharepoint Centrakl Adminitration > Security > Manage Trust. I had some scenarios where adding the pure cert of the issuer was not enough.