I'm trying to solve this issue for a while without luck, may be someone with more Sharepoint experience will be able to pinpoint my issue.

Exception stacktrace in Sharepoint logs looks like this:

System.IdentityModel.Tokens.SecurityTokenException: The issuer of the token is not a trusted issuer.    
at Microsoft.SharePoint.IdentityModel.SPLocalIssuerNameRegistry.GetIssuerName(SecurityToken securityToken)     
at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.CreateClaims(SamlSecurityToken samlSecurityToken)     
at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token)     
at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ValidateToken(SecurityToken token)     
at Microsoft.IdentityModel.Web.TokenReceiver.AuthenticateToken(SecurityToken token, Boolean ensureBearerToken, String endpointUri)     
at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequest request)     
at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)     
at Microsoft.SharePoint.IdentityModel.SPFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs eventArgs)     
at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()     
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

I've looked at the decompiled code, it looks like this:

 if (!accessProvider.SigningCertificate.Equals((X509Certificate) x509SecurityToken.Certificate))
    throw new SecurityTokenException(SPResource.GetString("IssuerIsNotTrusted"));

So it looks like received security token and access provider certificates do not match. I went further, made crash dump, loaded into windbg and tried to find what certificate has accessProvider, not sure if I was searching in right place, but if I was, then it had wrong certificate - it's subject was CN=SharePoint Security Token Service, OU=SharePoint, O=Microsoft, C=US, clearly not mine configured.

I was registering mine identity provider like this:

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\temp\wcfsts.dev.cer")
$map1 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "Display Name" –SameAsIncoming
$realm = "http://sp2013.testweb.local"
$ap = New-SPTrustedIdentityTokenIssuer -Name "WSFederationSTS" -Description "WCF STS." –Realm $realm -ClaimsMappings $map1 -ImportTrustCertificate $cert -SignInUrl "http://wcfsts.dev/WSFederationSecurityTokenService.svc/Issue" -IdentifierClaim $map1.InputClaimType

Also I've registered certificate with New-SPTrustedRootAuthority.

  • Not sure at all, but could it be you need to add a SPTrustedSecurityTokenIssuer instead? – Gert Braspenning Sep 18 '14 at 12:07
  • Check if thumbprints of your Get-SPTrustedIdentityTokenIssuer|SigningCertificate and sert registred in Central Administration /_admin/ManageTrust.aspx are the same – Ruslan Dayanov Sep 18 '14 at 12:17
  • @RuslanDayanov - thumbprints are the same. – Giedrius Sep 18 '14 at 12:21
  • @GertBraspenning - I was wondering so too, but if I add only SPTrustedSecurityTokenIssuer - I can't make my SP site to use it, as it is not displayed on the list, may be I misunderstand something fundamentally then. – Giedrius Sep 18 '14 at 12:23
  • did you add that certificate using New-SPTrustedRootAuthority -Name....or like this $root = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("c:\temp\newcert.cer") New-SPTrustedRootAuthority -Name "SP Signing Root Authority" -Certificate $root – Waqas Sarwar MVP Sep 18 '14 at 15:12

I found the problem accidentally, by looking what I might have done wrong.
I was looking to Claims Walkthrough and noticed, that they register token issuer using C# code, so decided to do the same and they used provider realm "https://intranet.contoso.com/_trust/", so I just changed it to have my domain, while leaving "_trust" part - and it started to work, so exception in logs was very misleading.

After this, I found blog post with the same issue, wondering why I didn't noticed it before.

| improve this answer | |

I was following some instructions from this link: https://support.microsoft.com/en-us/help/3042604/the-convert-spwebapplication-command-cannot-convert-from-windows-claim

It used the following format for the New-SPTrustedIdentityTokenIssuer command:

$ap = New-SPTrustedIdentityTokenIssuer -Name $tokenIdentityProviderName -Description $TrustedIdentityTokenIssuerDescription -realm $siteRealm -ImportTrustCertificate $adfsCert -SignInUrl $signInUrl -UseDefaultConfiguration -IdentifierClaimIs EMAIL -RegisteredIssuerName $siteRealm

I wasn't sure what to put for RegisteredIssuerName, and had previously left it blank when it was working, but in this case I set it to the same as the $tokenIdentityProviderName.

I started getting the "The issuer of the token is not a trusted issuer" error after that.

I cleared the value for RegisteredIssuerName:

Set-SPTrustedIdentityTokenIssuer -Identity $ap  -RegisteredIssuerName ""

And that resolved the issue for me.

I believe that for RegisteredIssuerName to work, you may need to add an issuerNameRegistry entry to the web.config to specify trusted token issuers.

  Microsoft.IdentityModel, Version=, Culture=neutral, 
      <add thumbprint="99fcfe2c70ebb571020ca8aa1b7633dfe1fa1d58" name="http://localhost:48924/WingtipSTS/" />

Additional source: https://docs.microsoft.com/en-us/previous-versions/office/developer/sharepoint-2010/ff955607(v=office.14)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.