1

I am implementing ADFS in SP2013. Everything is working in SP except workflow manager. I found that when I execute a 2013 workflow using an NTLM account, it works. When I log in using ADFS, the workflow suspends with the following error:

"There has been an error authenticating the request.\";category=\"invalid_client\""]

I have read that WFM uses the UPN claim type to look up the user in UPA. We converted users to ADFS using the Email Address claim type. I suspect it can't find a match. Any ideas? Is there a way to tell WFM to us the email address?

Follow up: I tried to map the User Principle Name in the UPA to "mail" and ran a full sync with no success. Then I mapped the Claim Type Identifier property to "userPrincipleName", ran a full sync, and surprisingly that didn't work either. Is anyone aware if workflow manager even works with ADFS?

Improve this question

2 Answers 2

Reset to default
0

To troubleshoot the issue, check things below:

  1. Check the information about the error in the event log in the workflow manager server.

  2. Check if the User profile synchronization is started.

  3. Run a full synchronization of User Profile Application with ADFS users.

  4. Activate the “Workflows can use app permissions” feature in the site features.

There is a similar post:

https://social.technet.microsoft.com/Forums/en-US/c8c60eea-910f-4aab-9bb9-dac9510a3dbc/there-has-been-an-error-authenticating-the-requestcategoryinvalidclient?forum=sharepointadmin

More reference:

Problem with 2013 Workflow Instance geting suspended with “There has been an error authenticating the request” massage.

https://sharepointpixels.wordpress.com/2016/10/25/problem-with-2013-workflow-gets-suspended-with-there-has-been-an-error-authenticating-the-request-massage/

Improve this answer
2
  • Thanks Amy_SPWX, I did all that. Everything is working. I can even create and publish 2013 workflows using ADFS (SPD prompts me to select an authentication method) and run them under an ntlm account. I read in a post someone from Trevor Seward something about rehydrating WFM but I don't know what that means. I might have to open a support case with MS
    – steveareeno
    Commented Jan 26, 2018 at 13:27
  • Clarification: when I said everything is working I meant the items you listed in steps 1-4. Still getting the 401 error
    – steveareeno
    Commented Jan 26, 2018 at 16:18
0

I found out what my issue was. I had a UPA sync connection to AD for both the NTLM users and ADFS users, so I had two SP profiles for each user. When I delete the NTLM user profile for my account and tested a workflow, it worked. I planned on deleting the NTLM profiles and sync connection once the conversion and testing was complete. Didn't think it would affect anything leaving it there for the time being.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.