I'm integrating Custom Java-IDP with SharePoint2016 using Claims Based Authentication (using WSFed11). ClaimTypeInformation shows following info.
PS C:\Users\windows> $ap.ClaimTypeInformation
DisplayName : EmailAddress
InputClaimType : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
MappedClaimType : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
IsIdentityClaim : True
AcceptOnlyKnownClaimValues : False
ClaimValueModificationAction : None
ClaimValueModificationArgument :
KnownClaimValues : {}
UpgradedPersistedProperties : {}
On receiving the SAML token, the SharePoint produces following errors/ exceptions:
Trusted login provider 'Cool_IDP' is not sending configured input identity claim type 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'.
STS Call: Failed to issue new security token. Exception: System.ServiceModel.FaultException: The trusted login provider did not supply a token accepted by this farm.
at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.SPRequestInfo.ValidateTrustedLoginRequest(SPRequestSecurityToken request)
at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.SPRequestInfo.InitializeForFederationAuthType(SPRequestSecurityToken request)
at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.GetTokenLifetime(Lifetime requestLifetime)
at Microsoft.IdentityModel.SecurityTokenService.SecurityTokenService.Issue(IClaimsPrincipal principal, RequestSecurityToken request)
at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.Issue(IClaimsPrincipal principal, RequestSecurityToken request)
SPSecurityContext: Request for security token failed with exception: System.ServiceModel.FaultException: The trusted login provider did not supply a token accepted by this farm.
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.ReadResponse(Message response)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst, RequestSecurityTokenResponse& rstr)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst)
at Microsoft.SharePoint.SPSecurityContext.SecurityTokenForContext(Uri context, Boolean bearerToken, SecurityToken onBehalfOf, SecurityToken actAs, SecurityToken delegateTo, SPRequestSecurityTokenProperties properties)
An exception occurred when trying to issue security token: The trusted login provider did not supply a token accepted by this farm..
Claims Saml Sign-In: Received saml is invalid. Could not find identity claim. Failed to get local token. Redirecting to error page.
SPFederationAuthenticationModule.GetReturnUrlFromResponse: Return url 'http://sharepointer/_layouts/15/Authenticate.aspx?Source=/' has same prefix as current context url 'http://sharepointer/_trust'.
Claims Saml Sign-In: Redirecting to error page '/_login/default.aspx?errorCode=TrustedMissingIdentityClaimSource=http%3A%2F%2Fsharepointer%2F%5Flayouts%2F15%2FAuthenticate%2Easpx%3FSource%3D%252F'.
Indeed, IDP sends the SAML token with same AttributeNamespace as that of configured via $emailClaimMap. But still it says, Trusted login provider 'Cool_IDP' is not sending configured input identity claim type 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'.
See below snippet.
...
<saml:AttributeStatement>
<saml:Subject>
<saml:NameIdentifier+Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</saml:NameIdentifier>
<saml:SubjectConfirmation>
<saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Attribute+AttributeName="EmailAddress"+AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
<saml:AttributeValue>[email protected]</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
...
Please refer the complete SAML token message below.
<wst:RequestSecurityTokenResponse>
<wst:TokenType>urn:oasis:names:tc:SAML:1.0:assertion</wst:TokenType>
<wst:RequestedSecurityToken>
<saml:Assertion+AssertionID="id-ZJf89YVouG9kacNvzvI4g2aPCXY-"+IssueInstant="2018-03-20T20:41:10Z"+Issuer="https://coolidp.com/cool"+MajorVersion="1"+MinorVersion="1">
<saml:Conditions+NotBefore="2018-03-20T20:40:40Z"+NotOnOrAfter="2018-03-20T20:46:40Z">
<saml:AudienceRestrictionCondition>
<saml:Audience>urn:sharepoint:SP80Portal</saml:Audience>
</saml:AudienceRestrictionCondition>
</saml:Conditions>
<saml:AuthenticationStatement+AuthenticationInstant="2018-03-20T20:41:10Z"+AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password">
<saml:Subject>
<saml:NameIdentifier+Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</saml:NameIdentifier>
<saml:SubjectConfirmation>
<saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
</saml:SubjectConfirmation>
</saml:Subject>
</saml:AuthenticationStatement>
<saml:AttributeStatement>
<saml:Subject>
<saml:NameIdentifier+Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</saml:NameIdentifier>
<saml:SubjectConfirmation>
<saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Attribute+AttributeName="EmailAddress"+AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
<saml:AttributeValue>[email protected]</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
<dsig:Signature>
<dsig:SignedInfo>
<dsig:CanonicalizationMethod+Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<dsig:SignatureMethod+Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<dsig:Reference+URI="#id-ZJf89YVouG9kacNvzvI4g2aPCXY-">
<dsig:Transforms>
<dsig:Transform+Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<dsig:Transform+Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</dsig:Transforms>
<dsig:DigestMethod+Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<dsig:DigestValue>pl+rlwstQI7j2H2ntcaaPIzSk7JPCebqReyQz6/vUuYQ=</dsig:DigestValue>
</dsig:Reference>
</dsig:SignedInfo>
<dsig:SignatureValue>J2inQbWWU9gNwY..........</dsig:SignatureValue>
<dsig:KeyInfo>
<dsig:X509Data>
<dsig:X509Certificate>MIIDYDCCAkig..........</dsig:X509Certificate>
</dsig:X509Data>
</dsig:KeyInfo>
</dsig:Signature>
</saml:Assertion>
</wst:RequestedSecurityToken>
<policy:AppliesTo>
<wa:EndpointReference>
<wa:Address>urn:sharepoint:SP80Portal</wa:Address>
</wa:EndpointReference>
</policy:AppliesTo>
<wst:RequestedAttachedReference>
<wsse:SecurityTokenReference>
<wsse:KeyIdentifier+ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID">id-ZJf89YVouG9kacNvzvI4g2aPCXY-</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
</wst:RequestedAttachedReference>
<wst:RequestedUnattachedReference>
<wsse:SecurityTokenReference>
<wsse:KeyIdentifier+ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID">id-ZJf89YVouG9kacNvzvI4g2aPCXY-</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
</wst:RequestedUnattachedReference>
<wst:Lifetime>
<Created>2018-03-20T20:40:40Z</Created>
<Expires>2018-03-20T20:46:40Z</Expires>
</wst:Lifetime>
</wst:RequestSecurityTokenResponse>
