2

We have a properly working SP2013 with ADFS environment on Amazon(EC2). We are using PING Fedrate as our SAML Token Provider. Everything was working fine till yesterday. Every user started getting following error, enter image description here

The event logs on the ADFS server shows, Event ID 364 with following details,

Encountered error during federation passive request.

Exception details: Microsoft.IdentityServer.Web.UnsupportedSamlResponseException: MSIS7029: The SAML response has content that is not supported. at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseForProtocolResponse(FederationPassiveContext federationPassiveContext) at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponse(SecurityToken securityToken)

No patching was done on servers. No new known installations were done. Nothing known seems to change.

Any help would be greatly appreciated.

  • did you see any error in the SharePoint logs as well? try IIS reset on the SharePoint server, also reset the browser cache – Waqas Sarwar MVP Feb 17 '15 at 20:01
  • Try to make backup and remove hotfixes KB2843638 and KB2843639, like described here social.technet.microsoft.com/forums/windowsserver/en-US/… – Gennady G Feb 17 '15 at 20:49
  • Thanks Waqas and Gennady. We got it resolved. I will post the details as answer. So that it may help somebody in future. – Amit Tyagi Feb 17 '15 at 23:34
1

So, on our domain controller, the time was 10 min. ahead of the actual time. When it was corrected the users were able to enter normally.

We are assuming that the time difference was interfering with the encryption/decryption of the SAML token and hence the error says The SAML response has content that is not supported.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.