SharePoint 2016 workflow does not send mail but Alerts works properlly

Question

Meanwhile try to create a simple workflow with SDP 2013 I faced an issue.

The Simple workflow does not send the email meanwhile :

• Alerts notifications works properly and sends mail without problem. So the CA> system setting > mail configuration is right.
• UPA is working and sync with no error
• ULS throw this exception

STS Call Claims Saml: Problem getting output claims identity. Exception: 'Microsoft.Office.Server.UserProfiles.UserProfileApplicationNotAvailableException: UserProfileApplicationNotAvailableException_Logging :: UserProfileApplicationProxy.GetRawPartitionID has null proxy
at Microsoft.Office.Server.Administration.UserProfileApplicationProxy.GetRawPartitionID(SPServiceContext serviceContext)
at Microsoft.Office.Server.UserProfiles.ProfileManagerBase..ctor(SPServiceContext serviceContext)
at Microsoft.Office.Server.UserProfiles.ProfileManagerBase..ctor(SPServiceContext serviceContext, Boolean ignorePrivacy)
at Microsoft.Office.Server.UserProfiles.UserProfileManager..ctor(SPServiceContext serviceContext, Boolean IgnoreUserPrivacy, Boolean backwardCompatible)
at Microsoft.Office.Server.Security.UserProfileIdentityClaimMapper.<>c__DisplayClass6.b__0()
at Microsoft.SharePoint.Utilities.SecurityContext.RunAsProcess(CodeToRunElevated secureCode)
at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(WaitCallback secureCode, Object param)
at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(CodeToRunElevated secureCode)
at Microsoft.Office.Server.Security.UserProfileIdentityClaimMapper.GetMappedIdentityClaim(Uri context, IEnumerable1 identityClaims)
at Microsoft.SharePoint.IdentityModel.SPIdentityClaimMapperOperations.GetClaimFromExternalMapper(Uri contextUri, List1 claims)
at Microsoft.SharePoint.IdentityModel.SPIdentityClaimMapperOperations.ResolveUserIdentityClaim(Uri contextUri, ClaimCollection inputClaims)
at Microsoft.SharePoint.IdentityModel.SPIdentityClaimMapperOperations.GetIdentityClaim(Uri contextUri, ClaimCollection inputClaims, SPCallingIdentityType callerType)
at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.GetLogonIdentityClaim(SPRequestInfo requestInfo, IClaimsIdentity inputIdentity, IClaimsIdentity outputIdentity, SPCallingIdentityType callerType)
at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.EnsureSharePointClaims(SPRequestInfo requestInfo, IClaimsIdentity outputIdentity, SPCallingIdentityType callerType)
at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.AugmentOutputIdentityForRequest(SPRequestInfo requestInfo, IClaimsIdentity outputIdentity)
at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.GetOutputClaimsIdentity(IClaimsPrincipal principal, RequestSecurityToken request, Scope scope)'.

• Network traces shows the smtp traffic

where is block

Answer 1

From the error above, seems like your User Profile Service Application is not available.

Please go to SharePoint Central Administration and check if User Profile Service Application is started.

Another cause could be on the answer no. 2 on this post.

Answer 2

Although the second point in Ganesha's answer in the post help me to fix the problem:

Go to UserProfile service(Any SA) and select the Permissions option and all above users give the same permissions.

I'd like to add further information the answer and isolate the right user account so next collegaues can implement the solution with a little bit more security In order to identify what exact user is throwing the exception , filter the uls log by correlation and filter by string :

"Current thread identity is claim auth"

The Uls shouw something like this

Current thread identity is claim auth. Result: 'i:0).w|s-1-5-21-3295615728-2786961072-2904720250-1917'.

now select the line and remove the last filter , the next three lines in the uls log will point that the user failed to connect with the UPA, and the exceptions are rigth after them

Open a Powershell AD module console and use this script, remeber use your user sid value in the scrip

$objSID = New-Object System.Security.Principal.SecurityIdentifier `
("S-1-5-21-1454471165-1004335555-1606985555-5555")
$objUser = $objSID.Translate(System.Security.Principal.NTAccount]) 
$objUser.Value

The script will return the user account you have to add to the UPA permission