1

I'm integrating Custom Java-IDP with SharePoint2016 using Claims Based Authentication (using WSFed11). ClaimTypeInformation shows following info.

PS C:\Users\windows> $ap.ClaimTypeInformation

    DisplayName                    : EmailAddress
    InputClaimType                 : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
    MappedClaimType                : http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
    IsIdentityClaim                : True
    AcceptOnlyKnownClaimValues     : False
    ClaimValueModificationAction   : None
    ClaimValueModificationArgument :
    KnownClaimValues               : {}
    UpgradedPersistedProperties    : {}

On receiving the SAML token, the SharePoint produces following errors/ exceptions:

Trusted login provider 'Cool_IDP' is not sending configured input identity claim type 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'.

STS Call: Failed to issue new security token. Exception: System.ServiceModel.FaultException: The trusted login provider did not supply a token accepted by this farm.    
 at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.SPRequestInfo.ValidateTrustedLoginRequest(SPRequestSecurityToken request)    
 at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.SPRequestInfo.InitializeForFederationAuthType(SPRequestSecurityToken request)    
 at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.GetTokenLifetime(Lifetime requestLifetime)    
 at Microsoft.IdentityModel.SecurityTokenService.SecurityTokenService.Issue(IClaimsPrincipal principal, RequestSecurityToken request)    
 at Microsoft.SharePoint.IdentityModel.SPSecurityTokenService.Issue(IClaimsPrincipal principal, RequestSecurityToken request)

SPSecurityContext: Request for security token failed with exception: System.ServiceModel.FaultException: The trusted login provider did not supply a token accepted by this farm.    
 at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.ReadResponse(Message response)    
 at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst, RequestSecurityTokenResponse& rstr)    
 at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannel.Issue(RequestSecurityToken rst)    
 at Microsoft.SharePoint.SPSecurityContext.SecurityTokenForContext(Uri context, Boolean bearerToken, SecurityToken onBehalfOf, SecurityToken actAs, SecurityToken delegateTo, SPRequestSecurityTokenProperties properties)

An exception occurred when trying to issue security token: The trusted login provider did not supply a token accepted by this farm..

Claims Saml Sign-In: Received saml is invalid. Could not find identity claim. Failed to get local token. Redirecting to error page.

SPFederationAuthenticationModule.GetReturnUrlFromResponse: Return url 'http://sharepointer/_layouts/15/Authenticate.aspx?Source=/' has same prefix as current context url 'http://sharepointer/_trust'.

Claims Saml Sign-In: Redirecting to error page '/_login/default.aspx?errorCode=TrustedMissingIdentityClaimSource=http%3A%2F%2Fsharepointer%2F%5Flayouts%2F15%2FAuthenticate%2Easpx%3FSource%3D%252F'.

Indeed, IDP sends the SAML token with same AttributeNamespace as that of configured via $emailClaimMap. But still it says, Trusted login provider 'Cool_IDP' is not sending configured input identity claim type 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'.

See below snippet.

...
<saml:AttributeStatement>
    <saml:Subject>
        <saml:NameIdentifier+Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</saml:NameIdentifier>
        <saml:SubjectConfirmation>
            <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
        </saml:SubjectConfirmation>
    </saml:Subject>
    <saml:Attribute+AttributeName="EmailAddress"+AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
        <saml:AttributeValue>[email protected]</saml:AttributeValue>
    </saml:Attribute>
</saml:AttributeStatement>
...

Please refer the complete SAML token message below.

<wst:RequestSecurityTokenResponse>
    <wst:TokenType>urn:oasis:names:tc:SAML:1.0:assertion</wst:TokenType>
    <wst:RequestedSecurityToken>
        <saml:Assertion+AssertionID="id-ZJf89YVouG9kacNvzvI4g2aPCXY-"+IssueInstant="2018-03-20T20:41:10Z"+Issuer="https://coolidp.com/cool"+MajorVersion="1"+MinorVersion="1">
            <saml:Conditions+NotBefore="2018-03-20T20:40:40Z"+NotOnOrAfter="2018-03-20T20:46:40Z">
                <saml:AudienceRestrictionCondition>
                    <saml:Audience>urn:sharepoint:SP80Portal</saml:Audience>
                </saml:AudienceRestrictionCondition>
            </saml:Conditions>
            <saml:AuthenticationStatement+AuthenticationInstant="2018-03-20T20:41:10Z"+AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password">
                <saml:Subject>
                    <saml:NameIdentifier+Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</saml:NameIdentifier>
                    <saml:SubjectConfirmation>
                        <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
                    </saml:SubjectConfirmation>
                </saml:Subject>
            </saml:AuthenticationStatement>
            <saml:AttributeStatement>
                <saml:Subject>
                    <saml:NameIdentifier+Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</saml:NameIdentifier>
                    <saml:SubjectConfirmation>
                        <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
                    </saml:SubjectConfirmation>
                </saml:Subject>
                <saml:Attribute+AttributeName="EmailAddress"+AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
                    <saml:AttributeValue>[email protected]</saml:AttributeValue>
                </saml:Attribute>
            </saml:AttributeStatement>
            <dsig:Signature>
                <dsig:SignedInfo>
                    <dsig:CanonicalizationMethod+Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    <dsig:SignatureMethod+Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
                    <dsig:Reference+URI="#id-ZJf89YVouG9kacNvzvI4g2aPCXY-">
                        <dsig:Transforms>
                            <dsig:Transform+Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                            <dsig:Transform+Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        </dsig:Transforms>
                        <dsig:DigestMethod+Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                        <dsig:DigestValue>pl+rlwstQI7j2H2ntcaaPIzSk7JPCebqReyQz6/vUuYQ=</dsig:DigestValue>
                    </dsig:Reference>
                </dsig:SignedInfo>
                <dsig:SignatureValue>J2inQbWWU9gNwY..........</dsig:SignatureValue>
                <dsig:KeyInfo>
                    <dsig:X509Data>
                        <dsig:X509Certificate>MIIDYDCCAkig..........</dsig:X509Certificate>
                    </dsig:X509Data>
                </dsig:KeyInfo>
            </dsig:Signature>
        </saml:Assertion>
    </wst:RequestedSecurityToken>
    <policy:AppliesTo>
        <wa:EndpointReference>
            <wa:Address>urn:sharepoint:SP80Portal</wa:Address>
        </wa:EndpointReference>
    </policy:AppliesTo>
    <wst:RequestedAttachedReference>
        <wsse:SecurityTokenReference>
            <wsse:KeyIdentifier+ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID">id-ZJf89YVouG9kacNvzvI4g2aPCXY-</wsse:KeyIdentifier>
        </wsse:SecurityTokenReference>
    </wst:RequestedAttachedReference>
    <wst:RequestedUnattachedReference>
        <wsse:SecurityTokenReference>
            <wsse:KeyIdentifier+ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID">id-ZJf89YVouG9kacNvzvI4g2aPCXY-</wsse:KeyIdentifier>
        </wsse:SecurityTokenReference>
    </wst:RequestedUnattachedReference>
    <wst:Lifetime>
        <Created>2018-03-20T20:40:40Z</Created>
        <Expires>2018-03-20T20:46:40Z</Expires>
    </wst:Lifetime>
</wst:RequestSecurityTokenResponse>

2 Answers 2

1

Two issues found during this exercise:

  1. Time difference between 'NotBefore and NotOnOrAfter in 'Conditions' statement of SAML Assertion must be >=10 minutes interval. SharePoint expects more time validity of SAML Assertion.
  2. Custom IDP must send AttributeNamespace as "http://schemas.xmlsoap.org/ws/2005/05/identity/claims" and NOT "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress". See below RSTR snippet.
<saml:AttributeStatement>
    <saml:Subject>
        <saml:NameIdentifier+Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</saml:NameIdentifier>
        <saml:SubjectConfirmation>
            <saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</saml:ConfirmationMethod>
        </saml:SubjectConfirmation>
    </saml:Subject>
    <saml:Attribute+AttributeName="emailaddress"+AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims">
        <saml:AttributeValue>[email protected]</saml:AttributeValue>
    </saml:Attribute>
</saml:AttributeStatement>
0

Try to change the “urn:oasis:names:tc:SAML:1.0:cm:bearer” to “urn:oasis:names:tc:SAML:2.0:cm:bearer”.

Check the example for the SAML 2.0 below:

https://developer.salesforce.com/docs/atlas.en-us.sso.meta/sso/sso_saml_assertion_examples.htm

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.