0

I'm integrating Custom Java-IDP with SharePoint2016 using Claims Based Authentication (using WSFed11). ClaimTypeInformation shows following info.

PS C:\Users\windows> $ap.ClaimTypeInformation

    DisplayName                    : EmailAddress
    InputClaimType                 : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
    MappedClaimType                : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
    IsIdentityClaim                : True
    AcceptOnlyKnownClaimValues     : False
    ClaimValueModificationAction   : None
    ClaimValueModificationArgument :
    KnownClaimValues               : {}
    UpgradedPersistedProperties    : {}

On receiving the SAML token, the SharePoint produces following errors/ exceptions:

Trusted login provider 'Cool_IDP' is not sending configured input identity claim type 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'.

STS Call: Failed to issue new security token. Exception: System.ServiceModel.FaultException: The trusted login provider did not supply a token accepted by this farm.    
 at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.SPRequestInfo.ValidateTrustedLoginRequest(SPRequestSecurityToken request)    
 at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.SPRequestInfo.InitializeForFederationAuthType(SPRequestSecurityToken request)    
 at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.GetTokenLifetime(Lifetime requestLifetime)    
 at Microsoft.IdentityModel.SecurityTokenService.SecurityTokenService.Issue(IClaimsPrincipal principal, RequestSecurityToken request)    
 at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.Issue(IClaimsPrincipal principal, RequestSecurityToken request)

SPSecurityContext: Request for security token failed with exception: System.ServiceModel.FaultException: The trusted login provider did not supply a token accepted by this farm.    
 at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.ReadResponse(Message response)    
 at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst, RequestSecurityTokenResponse& rstr)    
 at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst)    
 at Microsoft.SharePoint.SPSecurityContext.SecurityTokenForContext(Uri context, Boolean bearerToken, SecurityToken onBehalfOf, SecurityToken actAs, SecurityToken delegateTo, SPRequestSecurityTokenProperties properties)

An exception occurred when trying to issue security token: The trusted login provider did not supply a token accepted by this farm..

Claims Saml Sign-In: Received saml is invalid. Could not find identity claim. Failed to get local token. Redirecting to error page.

SPFederationAuthenticationModule.GetReturnUrlFromResponse: Return url 'http://sharepointer/_layouts/15/Authenticate.aspx?Source=/' has same prefix as current context url 'http://sharepointer/_trust'.

Claims Saml Sign-In: Redirecting to error page '/_login/default.aspx?errorCode=TrustedMissingIdentityClaimSource=http%3A%2F%2Fsharepointer%2F%5Flayouts%2F15%2FAuthenticate%2Easpx%3FSource%3D%252F'.

Indeed, IDP sends the SAML token with same AttributeNamespace as that of configured via $emailClaimMap. But still it says, Trusted login provider 'Cool_IDP' is not sending configured input identity claim type 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'.

See below snippet.

...
<saml:AttributeStatement>
    <saml:Subject>
        <saml:NameIdentifier+Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">elwoodf1@coolidp.com</saml:NameIdentifier>
        <saml:SubjectConfirmation>
            <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
        </saml:SubjectConfirmation>
    </saml:Subject>
    <saml:Attribute+AttributeName="EmailAddress"+AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
        <saml:AttributeValue>elwoodf1@coolidp.com</saml:AttributeValue>
    </saml:Attribute>
</saml:AttributeStatement>
...

Please refer the complete SAML token message below.

<wst:RequestSecurityTokenResponse>
    <wst:TokenType>urn:oasis:names:tc:SAML:1.0:assertion</wst:TokenType>
    <wst:RequestedSecurityToken>
        <saml:Assertion+AssertionID="id-ZJf89YVouG9kacNvzvI4g2aPCXY-"+IssueInstant="2018-03-20T20:41:10Z"+Issuer="https://coolidp.com/cool"+MajorVersion="1"+MinorVersion="1">
            <saml:Conditions+NotBefore="2018-03-20T20:40:40Z"+NotOnOrAfter="2018-03-20T20:46:40Z">
                <saml:AudienceRestrictionCondition>
                    <saml:Audience>urn:sharepoint:SP80Portal</saml:Audience>
                </saml:AudienceRestrictionCondition>
            </saml:Conditions>
            <saml:AuthenticationStatement+AuthenticationInstant="2018-03-20T20:41:10Z"+AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password">
                <saml:Subject>
                    <saml:NameIdentifier+Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">elwoodf1@coolidp.com</saml:NameIdentifier>
                    <saml:SubjectConfirmation>
                        <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
                    </saml:SubjectConfirmation>
                </saml:Subject>
            </saml:AuthenticationStatement>
            <saml:AttributeStatement>
                <saml:Subject>
                    <saml:NameIdentifier+Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">elwoodf1@coolidp.com</saml:NameIdentifier>
                    <saml:SubjectConfirmation>
                        <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
                    </saml:SubjectConfirmation>
                </saml:Subject>
                <saml:Attribute+AttributeName="EmailAddress"+AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
                    <saml:AttributeValue>elwoodf1@coolidp.com</saml:AttributeValue>
                </saml:Attribute>
            </saml:AttributeStatement>
            <dsig:Signature>
                <dsig:SignedInfo>
                    <dsig:CanonicalizationMethod+Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <dsig:SignatureMethod+Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
                    <dsig:Reference+URI="#id-ZJf89YVouG9kacNvzvI4g2aPCXY-">
                        <dsig:Transforms>
                            <dsig:Transform+Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                            <dsig:Transform+Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </dsig:Transforms>
                        <dsig:DigestMethod+Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                        <dsig:DigestValue>pl+rlwstQI7j2H2ntcaaPIzSk7JPCebqReyQz6/vUuYQ=</dsig:DigestValue>
                    </dsig:Reference>
                </dsig:SignedInfo>
                <dsig:SignatureValue>J2inQbWWU9gNwY..........</dsig:SignatureValue>
                <dsig:KeyInfo>
                    <dsig:X509Data>
                        <dsig:X509Certificate>MIIDYDCCAkig..........</dsig:X509Certificate>
                    </dsig:X509Data>
                </dsig:KeyInfo>
            </dsig:Signature>
        </saml:Assertion>
    </wst:RequestedSecurityToken>
    <policy:AppliesTo>
        <wa:EndpointReference>
            <wa:Address>urn:sharepoint:SP80Portal</wa:Address>
        </wa:EndpointReference>
    </policy:AppliesTo>
    <wst:RequestedAttachedReference>
        <wsse:SecurityTokenReference>
            <wsse:KeyIdentifier+ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID">id-ZJf89YVouG9kacNvzvI4g2aPCXY-</wsse:KeyIdentifier>
        </wsse:SecurityTokenReference>
    </wst:RequestedAttachedReference>
    <wst:RequestedUnattachedReference>
        <wsse:SecurityTokenReference>
            <wsse:KeyIdentifier+ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID">id-ZJf89YVouG9kacNvzvI4g2aPCXY-</wsse:KeyIdentifier>
        </wsse:SecurityTokenReference>
    </wst:RequestedUnattachedReference>
    <wst:Lifetime>
        <Created>2018-03-20T20:40:40Z</Created>
        <Expires>2018-03-20T20:46:40Z</Expires>
    </wst:Lifetime>
</wst:RequestSecurityTokenResponse>
0

Try to change the “urn:oasis:names:tc:SAML:1.0:cm:bearer” to “urn:oasis:names:tc:SAML:2.0:cm:bearer”.

Check the example for the SAML 2.0 below:

https://developer.salesforce.com/docs/atlas.en-us.sso.meta/sso/sso_saml_assertion_examples.htm

0

Two issues found during this exercise:

  1. Time difference between 'NotBefore and NotOnOrAfter in 'Conditions' statement of SAML Assertion must be >=10 minutes interval. SharePoint expects more time validity of SAML Assertion.
  2. Custom IDP must send AttributeNamespace as "http://schemas.xmlsoap.org/ws/2005/05/identity/claims" and NOT "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress". See below RSTR snippet.
<saml:AttributeStatement>
    <saml:Subject>
        <saml:NameIdentifier+Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">elwoodf1@cool.com</saml:NameIdentifier>
        <saml:SubjectConfirmation>
            <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
        </saml:SubjectConfirmation>
    </saml:Subject>
    <saml:Attribute+AttributeName="emailaddress"+AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
        <saml:AttributeValue>elwoodf1@cool.com</saml:AttributeValue>
    </saml:Attribute>
</saml:AttributeStatement>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.