I am configuring a POC for SharePoint with authentication to third party account provider and running into several issues and following the documentation provided by microsoft at http://technet.microsoft.com/en-us/library/cc731443(v=ws.10).aspx. Most of the documentation which I have seen are for ADFS 2.0 RTW

The issue is when I am a trying to the access the SharePoint site, I get redirected to the account provider ADFS site with NTLM prompt pop up. Once when I enter my credentials I get the following error

The token request for application with URL "https://spadfsweb.spdev.com/_layouts/Authenticate.aspx?Source=/" cannot be fulfilled because the URL does not identify any known trusting application.

Here is my setup

ADFS account provider (ADFS Role and DC are in separate machines)

  • Windows 2008 R2
  • ADFS role added
  • Has the following parameters for the ADFS
    • token signing certificate "sts.adfsaccount.spaccount.com"
    • Federation Service URI
      • urn:federation:accountprovider
    • Federation service endpoint url
      • https://sts.adfsaccount.spaccount.com/adfs/ls/
  • Exported the token signing certificate and imported that in resource partner ADFS

ADFS Resource Partner (ADFS role and DC are in separate machines)

  • Windows 2008 R2
  • ADFS role added
  • Has the following parameters for the ADFS
    • Token signing certificate "sts.staging.spresource.com"
    • Federation Service URI
      • urn:federation:resourceprovider
    • Federation service endpoint url
      • https://sts.staging.spresource.com/adfs/ls/
  • Has the following trusted application which is sharepoint
    • https://spadfsweb.spdev.com/_trust/, I have all sort of the combination like below
      • https://spadfsweb.spdev.com
      • https://spadfsweb.spdev.com/_layouts
  • Exported the token signing certificate and imported that into account partner ADFS

And below is the steps how I have configured the SharePoint site

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\Data\Certs\stsadfsaccount_exporttokensign.cer")
New-SPTrustedRootAuthority -Name "Account Token Signing Cert" -Certificate $cert
$map = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming
$map2 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" –SameAsIncoming
$ap = New-SPTrustedIdentityTokenIssuer -Name "Staging Provider"-Description "User account domain from adfs to provide authenitcation" -Realm "urn:federation:resourceprovider" -ImportTrustCertificate $cert -ClaimsMappings $map,$map2 -SignInUrl "https://sts.adfsaccount.spaccount.com/adfs/ls/" -IdentifierClaim http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

---SharePoint has the uri of resource provider, signing certificate of the account partner and adfs url of the account partner

Please let me know if I am doing something wrong.

Thanks Deepak

1 Answer 1


Did you configure SharePoint as the relying party in the "ADFS Account provider"? The "-realm" parameter of the SharePoint New-SPTrustedIdentityTokenIssuer cmdlet should be the identifier of SharePoint in ADFS. That is how ADFS knows who is requesting the token.

Nothing from your resource ADFS should be configured in SharePoint. It only talks with the account ADFS.

  • Thanks Paul. Actually I was using ADFS 1.0, I used the ADFS 2.0 and the configured the ADFS with the similar step and was able to work with ADFS and everything is working perfectly. Except that I figuring something similar to "NT\Authenticated Users" and provide a default read only permissions.
    – Deepak
    Apr 16, 2012 at 6:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.