1

I have two web applications, both set to authenticate via ADFS. The first one, ConnectTo, works fine. However the second one, MySites, always redirects to the first.

Here are my Relying Party Trustsin ADFS:

Relying Party Trusts

Here are the ConnectTo Relying Party Trust's Identifiers and endpoints. I have tried this with and without the URL identifier (https://connectto.sp2013dev.com/_trust/).

ConnectTo Identifiers ConnectTo Endpoints

Here are the MySites Relying Party Trust's Identifiers and endpoints. I have tried this with and without the URL identifier (https://mysites.sp2013dev.com/_trust/).

MySites Identifiers MySites Endpoints

In SharePoint, I have configured my trustedIdentityTokenIssuer and it works great for the first Web Application, ConnectTo. However, I am unable to add a second Web Application. The second web app, Mysites, is always redirected to ConnectTo once the user is authenticated.

Here are my provider realms as configured in my SPTrustedIdentityTokenIssuer, configured via the following command:

$id1 = "urn:sharepoint:MySites"
$uri1 = new-object System.Uri("https://mysites.sp2013dev.com")
$id2 = "urn:sharepoint:ConnectTo"
$uri2 = new-object System.Uri("https:// connectto.sp2013dev.com")

$ap.ProviderRealms.Add($uri1, $id1)
$ap.ProviderRealms.Add($uri2, $id2)
$ap.Update()

********************** EDIT ********************************

I have since removed the duplicate ConnectTo Provider Realm per @Waqas Sarwar MCSE suggestion.

Provider Realms 2

********************** EDIT ********************************

And here is the rest of my SPTrustedIdentityTokenIssuer, just in case.

SPTrustedIdentityTokenIssuer

The URL when I connect to the MySites WebApp is as follows:

https://sts.sp2013dev.com/adfs/ls?wa=wsignin1.0&wtrealm=urn%3asharepoint%3aConnectTo&wctx=http%3a%2f%2fmysites.sp2013dev.com%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F

The wtream is urn:sharepoint:ConnectTo but I assume that is because my default realm in the SPTrustedIdentityTokenIssuer is urn:sharepoint:ConnectTo. Could this be my problem?

If I add the MySites endpoint as the default endpoint to the ConnectTo Relying Party Trust, ConnectTo.sp2013dev.com is redirected to mysites.sp2013dev.com. Thus I feel my issue is with the provider realms of the SPTrustedIdentityTokenIssuer but I really cannot figure out this issue. Could someone provide insight as to why my configuration is incorrect? Thank you!

12
  • looks like duplicate entries for connectto, try to remove connecto..$uri2 = new-object System.Uri("https:// connectto.sp2013dev.com") ....$ap = ProviderRealms.Remove($uri2)
    – Waqas Sarwar MVP
    Commented Mar 4, 2016 at 14:48
  • could you please check, if not ADFS authetnication configured for mysite and you can able to login using your windows credential...also check the AAM settings..also check if you have host file which redirect to connectto site....i am thinking may be DNS not properly configured or aamor host file
    – Waqas Sarwar MVP
    Commented Mar 4, 2016 at 15:00
  • I removed the mysite provider realm but did not see a change. I reset the claims to windows token service, IIS, and the sharepoint timer. Is there anything else I need to do? Commented Mar 4, 2016 at 15:10
  • Also, Windows authentication works fine, the issue only occurs with ADFS authentication and I verified that my update to the provider realm actually stuck. Commented Mar 4, 2016 at 15:17
  • The URL when I connect to the MySites WebApp is as follows: sts.sp2013dev.com/adfs/… The wtream in the URL is urn:sharepoint:ConnectTo but I assume that is because my default realm in the SPTrustedIdentityTokenIssuer is urn:sharepoint:ConnectTo. Could this be my problem? Commented Mar 4, 2016 at 15:31

3 Answers 3

1
+100

looks like duplicate entries for connectto, So Please removes duplicate entry using the following PowerShell

$uri2 = new-object System.Uri("https:// connectto.sp2013dev.com")
$ap = ProviderRealms.Remove($uri2)

I would highly recommend that create the separate relying party package for each web application and then configure it in SharePoint.

1
  • Note that separate Relying Party Trust for each Web Application is not required if using ADFS 3.0.
    – Jussi Palo
    Commented Mar 2, 2017 at 13:12
0

Add the MySites as a separate relying party, it's one extra roundtrip but any authenticated user will be immediately sent to the MySites without having to log on again.

5
  • Mysites is a separate relying party. Thanks though! Commented Mar 4, 2016 at 14:36
  • And set the identifier in the MySite relying party to "urn:sharepoint:MySites" ;-)
    – Colin
    Commented Mar 4, 2016 at 14:36
  • The identifier in the MySites relying party is 'urn:sharepoint:MySites' Commented Mar 4, 2016 at 14:37
  • In the MySites relying party, use urn:sharepoint:mysites as the identifier (realm), in the connectto use urn:sharepoint:connectto. Remove all other identifiers
    – Colin
    Commented Mar 4, 2016 at 14:38
  • I had tried that too (actually first), where the only identifier was the urn for each relying party trust. Thanks for your help! Commented Mar 4, 2016 at 14:39
0

Actually we had the same issue, and the way we fixed it is by making sure that the alternative access mapping for all of the applications is HTTPS and all mention of HTTP URLs is removed, additionally we did this for those sites in IIS, so they were running on HTTPS only, again with all HTTP urls removed

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.