Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

My knowledge of claims is weak so please forgive me if something doesn't make sense.

When I try to log in to the SharePoint site using claims, I get the error:

Unknown SPRequest error occurred. More information. 0x80070005

Which is an Access Denied error to my understanding.

Fiddler loses all sight of my connection during the SSL tunnel to the TIP, so I get no clues from Fiddler.

The commands I used to set up the TIP are as follows:

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
  ("C:\myCert.pem")
New-SPTrustedRootAuthority -Name "Vordel Gateway Token Signing Root Authority" 
  -Certificate $cert
$map1 = New-SPClaimTypeMapping 
  "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" 
  -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming
$realm = "urn:myRealm.com"
$signinurl = "https://mySigninURL/sharepointSSO"
$ap = New-SPTrustedIdentityTokenIssuer -Name "Vordel" -Description 
  "Vordel Gateway Issuing SAML Token" -Realm $realm -ImportTrustCertificate 
  $cert -ClaimsMappings $map1 -SignInUrl $signinurl 
  -IdentifierClaim $map1.InputClaimType

After setting up the cert I checked in Central Admin | Security | Manage Trusts and the certificate is there.

I ensured that the Portal Super Reader and Super user accounts had the proper web application user policies applied. Then I ran the following Powershell:

$wa = Get-SPWebApplication -Identity "http://serverName"
$wa.Properties["portalsuperuseraccount"] = "i:0#.w|MyDomain\mySU"
$wa.Properties["portalsuperreaderaccount"] = "i:0#.w|MyDomain\mySR"
$wa.Update()

When I assign permissions to the site, I can search for users available through the TIP so I know I can hit the provider.

I know that I can see the XML returned by the TIP with all the claim info. The error occurs once the claim is redirected back to SharePoint.

share|improve this question
2  
What url are you getting the error at? Should be http://SITE_URL/_trust/. Anything in the ULS logs? –  Per Jakobsen Nov 1 '12 at 20:39
    
I navigate to this address: http://myServer/ SharePoint prompts me to select Windows authenication or my custom provider here: http://myServer/_login/default.aspx?ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3‌​fSource%3d%252F&Source=%2F I am redirected to this address (I can see the XML claim [SAML?]) https://mySigninURL/sharepointSSO?wa=wsignin1.0&wtrealm=urn%3amyRealm.com&wctx=‌​http%3a%2f%2fmyServer3%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F Finally, I am redirected here but I get a 500 error. http://myServer/_layouts/Authenticate.aspx?Source=%2F –  James Grizzle Nov 1 '12 at 20:58
    
The only thing of any value in the ULS logs is the vague Unknown SPRequest error occurred. More information. 0x80070005 error –  James Grizzle Nov 1 '12 at 21:01
    
So I turned on verbose logging, which exposed the following error, PermissionMask check failed. Asking for 0x00010000, have 0x00000000. So I turned on anonymous access just to check. Now I get absolutely no hint of an error in ULS but I still get a 500 error if I try to authenticate via the Vordel provider. –  James Grizzle Nov 2 '12 at 15:00
2  
Have you set any kind of User Policy at the web application level (e.g., all users coming in via the Vordel identity provider get Full Read access)? Typically, a permissions issue would manifest itself as the SharePoint "Access Denied" screen and not a generic error page, though. Also, have you tried testing using InPrivate browsing just to ensure there are no interfering cookies? (I have seen HTTP 405 errors when testing sometimes due to that.) –  Danny Jessee Nov 2 '12 at 15:45
add comment

1 Answer 1

up vote 0 down vote accepted

It turned out that I did not have all the certificates in the chain and the Vordel Gateway was not pointing back to the correct location. The guys at Vordel were very helpful in fixing this issue!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.