Override _layouts/Authenticate.aspx for claims based authentication (LiveID)

Question

I've configured claims-based authentication using Windows Live ID.

In Microsoft service manager the default return URL is as in WS-Federation specification:

https://domain.com/_trust/default.aspx

I have a page with a link that redirects to login.live.com. I have specified a return URL in MSM as

https://domain.com/_layouts/login.aspx

And recieve the following error:

Message : System.IdentityModel.Tokens.SecurityTokenException: The issuer of the token is not a trusted issuer. at Microsoft.SharePoint.IdentityModel.SPLocalIssuerNameRegistry.GetIssuerName(SecurityToken securityToken) at Microsoft.SharePoint.IdentityModel.SPPassiveIssuerNameRegistry.GetIssuerName(SecurityToken securityToken) at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.CreateClaims(SamlSecurityToken samlSecurityToken) at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token) at Microsoft.IdentityModel.Web.TokenReceiver.AuthenticateToken(SecurityToken token, Boolean ensureBearerToken, String endpointUri) at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.SignInWithResponseMessage

What are the requirements for such pages?

Edited: I'm able to login using default sign in page. What I'd like to do is to change it to smth custom ideally without login form. I.e. Follow Login link [reditrected]-> login.live.com (enter credentials) [redirected] -> _layouts/login.aspx where form for adding users to the site is located

Update:

First variant in not correct so I decided to use wctx param of the WS-Federation to get the Users PUID. So Request has Wreply param which contains required information. The problem is that after being redirected to MySite I am redirected to _layouts/Authenticate.aspx and the response is lost The solution I see is to implement custom page that overrides default authentication aspx page.

So URL will contain _layouts/MyAuthenticate.aspx instead of _layouts/Authenticate.aspx I don't think its very good but sounds like possible solution.

What is good approach to retrieve the wresult value?

Answer 1

You need to configure the farm to trust LiveID.

Technet has documentation on configuring claims for LiveID http://technet.microsoft.com/en-us/library/ff973117.aspx

Edit I have not implemented this myself, so I'm speaking just from knowledge of how I perceive it to work.

I don't think you need to edit the _trust/default.aspx page, but implement a custom login page that replaces _forms/default.aspx that automatically passes in the STS selection.

Claims process (I'll the post a link as soon as I find the original post I grabbed this from)

1. The user accesses site URL
2. The server responds with an HTTP status code of 302(temporary redirect). The target page is /_layouts/authenticate.aspx, with a query string parameter of Source pointing to the original user requested URL
3. The client requests /_layouts/authenticate.aspx (per the 302)
4. The server responds with another 302 redirect to /_login/default.aspx with a query string parameter of ReturnUrl that includes the authentication page and its query string.
5. The client requests the /_login/default.aspx page per 302.
6. The server responds with a page that prompts the user to select the authentication method.
7. The user selects the appropriate login provider from the drop-down list, and posts the response on /_login/default.aspx.
8. The server responds with a 302 /_trust/default.aspx with a query string parameter with the trust provider that the user selected, a ReturnUrl parameter that includes the authenticate.aspx page, and an additional query string parameter with the source
9. The client follows the redirect and gets /_trust/default.aspx per 302
10. The server responds with a 302 to the URL of the identity provider with a series of parameters that identify the site and a wctx parameter that matches the ReturnUrl query string.
11. The client and server iterate an exchange of information, based on the operation of the STS and then posts to /_trust/default.aspx. This post includes a Security Assertion Markup Language (SAML) token that includes the user's identity.
12. The server responds with a 302 to /_layouts/authenticate.aspxr. This value comes back from the claims provider as wctx in the form of a form post variable. During the redirect, the /_trust/default.aspx page writes two or more encrypted and encoded authentication cookies that are retransmitted on every request to the website. These cookies consist of one or more FedAuth cookies, and an rtFA cookie. The FedAuth cookies enable federated authorization, and the rtFA cookie enables signing out the user from all SharePoint sites, even if the sign-out process starts from a non-SharePoint site.
13. The client requests /_layouts/authenticate.aspx with a query string parameter of the source URL per the 302
14. The server responds with a 302 temporary redirect to the source URL.