SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to configure the LiveId integration with SharePoint 2010. MS Service Manager Settings:

Domain name:

DNS: urn:subdomain-dev:int

Default Return URL:

I've imported X509 certificate. After that I use following PowerShell Script to create TrustedIdentityTokenIssuer:

asnp microsoft.sharepoint.powershell
$realm = "urn:subdomain-dev:int"
$certfile = "C:\LiveID-INT.cer"
$rootcert = Get-PfxCertificate $certfile
New-SPTrustedRootAuthority "Live ID INT Root Authority" -Certificate $rootcert
$emailclaim = New-SPClaimTypeMapping -IncomingClaimType "" -IncomingClaimTypeDisplayName "" -SameAsIncoming
$upnclaim =  New-SPClaimTypeMapping -IncomingClaimType "" -IncomingClaimTypeDisplayName "UPN" -LocalClaimType ""
$authp = New-SPTrustedIdentityTokenIssuer -Name "LiveID INT" -Description "LiveID INT" -Realm $realm -ImportTrustCertificate $certfile -ClaimsMappings $emailclaim,$upnclaim -SignInUrl "" -IdentifierClaim ""

Problem: After creating the web application specifying in host creating SiteCollection and trying access it I receive the 500 Error in web browser. ULS logs shows Security Exception :

System.IdentityModel.Tokens.SecurityTokenException: The issuer of the token is not a trusted issuer.

I assume that it was not correctly mapped to the realm (or DNS). How should I specify my domain and DNS in Service Manager. Or any other ideas?

share|improve this question
up vote 0 down vote accepted

Make sure that the Web App you are configuring to use the Live ID provider has the exact Domain Name as the URL of your Web App.

In you example you have specified com in the wicked MSM application but use for your Web App. Either change your web app or the MSM registration.

share|improve this answer

I don´t have any good answer to your problem, but I can give you a tip of checking out my collegue MVP Wictor Wiléns great blog post about LiveID configuration divided in three series and see if you can get any ideas from that.

Part 1 -

Part 2 -

Part 3 -

Regards Johan

share|improve this answer
Thanks, these are really good resources, I've already used them. But it seems that my config settings I've provided are incorrect. So I'm wondering where I've made a mistake – AlexSSE May 19 '11 at 10:52

I would stop and use Azure ACS instead.

share|improve this answer
I like this suggestion. Azure ACS does seem interesting, but wouldn't that incur a cost? – Tom Resing Jun 23 '11 at 2:11

There is also an article on from Jeremy Thake on how that site was LiveID enabled. It might give you some other pointers to look at. It seems he took a lot of help from Wictor too.

share|improve this answer

Not to sign him up to help you, but Jeremy Thake did this for I'm sure if you reach out to him on Twitter (@jthake) he would give you a little guidance.

share|improve this answer

You have imported the certificate as mentioned. I've not yet configured a live id auth site, but could you check the certificate chain? is it a self signed? If not try to import the issuing root certificate to the trusted root authority (on the sharepoint box -> open a fresh mmc and add the certificate snap in for the computer account). Add the root certificate here. if this is not enough, than add the certificate of the root ca to the sharepoint Centrakl Adminitration > Security > Manage Trust. I had some scenarios where adding the pure cert of the issuer was not enough.

share|improve this answer

There is a great video on Authorization and Authentication Infrastucture setup and configuration by Paolo Pialorsi on channel 9. He explains multiple options with demos. I found it really useful.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.