I'm trying to configure the LiveId integration with SharePoint 2010. MS Service Manager Settings:

Domain name: domain.com

DNS: urn:subdomain-dev:int

Default Return URL: https://subdomain-dev.domain.com/SitePages/Home.aspx

I've imported X509 certificate. After that I use following PowerShell Script to create TrustedIdentityTokenIssuer:

asnp microsoft.sharepoint.powershell
$realm = "urn:subdomain-dev:int"
$certfile = "C:\LiveID-INT.cer"
$rootcert = Get-PfxCertificate $certfile
New-SPTrustedRootAuthority "Live ID INT Root Authority" -Certificate $rootcert
$emailclaim = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/claims/EmailAddress" -IncomingClaimTypeDisplayName "http://schemas.xmlsoap.org/claims/EmailAddress" -SameAsIncoming
$upnclaim =  New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier" -IncomingClaimTypeDisplayName "UPN" -LocalClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"
$authp = New-SPTrustedIdentityTokenIssuer -Name "LiveID INT" -Description "LiveID INT" -Realm $realm -ImportTrustCertificate $certfile -ClaimsMappings $emailclaim,$upnclaim -SignInUrl "https://login.live-int.com/login.srf" -IdentifierClaim "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier"

Problem: After creating the web application specifying in host subdomain-dev.domain.com creating SiteCollection and trying access it I receive the 500 Error in web browser. ULS logs shows Security Exception :

System.IdentityModel.Tokens.SecurityTokenException: The issuer of the token is not a trusted issuer.

I assume that it was not correctly mapped to the realm (or DNS). How should I specify my domain and DNS in Service Manager. Or any other ideas?

7 Answers 7


Make sure that the Web App you are configuring to use the Live ID provider has the exact Domain Name as the URL of your Web App.

In you example you have specified domain.com com in the wicked MSM application but use XXX.domain.com for your Web App. Either change your web app or the MSM registration.


I don´t have any good answer to your problem, but I can give you a tip of checking out my collegue MVP Wictor Wiléns great blog post about LiveID configuration divided in three series and see if you can get any ideas from that.

Part 1 - http://www.wictorwilen.se/Post/Visual-guide-to-Windows-Live-ID-authentication-with-SharePoint-2010-part-1.aspx

Part 2 - http://www.wictorwilen.se/Post/Visual-guide-to-Windows-Live-ID-authentication-with-SharePoint-2010-part-2.aspx

Part 3 - http://www.wictorwilen.se/Post/Visual-guide-to-Windows-Live-ID-authentication-with-SharePoint-2010-part-3.aspx

Regards Johan

  • Thanks, these are really good resources, I've already used them. But it seems that my config settings I've provided are incorrect. So I'm wondering where I've made a mistake
    – AlexSSE
    Commented May 19, 2011 at 10:52

I would stop and use Azure ACS instead.

  • I like this suggestion. Azure ACS does seem interesting, but wouldn't that incur a cost?
    – Tom Resing
    Commented Jun 23, 2011 at 2:11

There is also an article on nothingbutsharepoint.com from Jeremy Thake on how that site was LiveID enabled. It might give you some other pointers to look at. It seems he took a lot of help from Wictor too.


Not to sign him up to help you, but Jeremy Thake did this for nothingbutsharepoint.com. I'm sure if you reach out to him on Twitter (@jthake) he would give you a little guidance.


You have imported the certificate as mentioned. I've not yet configured a live id auth site, but could you check the certificate chain? is it a self signed? If not try to import the issuing root certificate to the trusted root authority (on the sharepoint box -> open a fresh mmc and add the certificate snap in for the computer account). Add the root certificate here. if this is not enough, than add the certificate of the root ca to the sharepoint Centrakl Adminitration > Security > Manage Trust. I had some scenarios where adding the pure cert of the issuer was not enough.


There is a great video on Authorization and Authentication Infrastucture setup and configuration by Paolo Pialorsi on channel 9. He explains multiple options with demos. I found it really useful.

Link: https://channel9.msdn.com/Events/TechEd/Europe/2013/SES-B402#fbid=

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.