ADFS 2.0 with SharePoint not recognized as trusted application and throwing

Question

I am configuring a POC for SharePoint with authentication to third party account provider and running into several issues and following the documentation provided by microsoft at http://technet.microsoft.com/en-us/library/cc731443(v=ws.10).aspx. Most of the documentation which I have seen are for ADFS 2.0 RTW

The issue is when I am a trying to the access the SharePoint site, I get redirected to the account provider ADFS site with NTLM prompt pop up. Once when I enter my credentials I get the following error

The token request for application with URL "https://spadfsweb.spdev.com/_layouts/Authenticate.aspx?Source=/" cannot be fulfilled because the URL does not identify any known trusting application.

Here is my setup

ADFS account provider (ADFS Role and DC are in separate machines)

• Windows 2008 R2
• ADFS role added
• Has the following parameters for the ADFS
  • token signing certificate "sts.adfsaccount.spaccount.com"
  • Federation Service URI
    • urn:federation:accountprovider
  • Federation service endpoint url
    • https://sts.adfsaccount.spaccount.com/adfs/ls/
• Exported the token signing certificate and imported that in resource partner ADFS

ADFS Resource Partner (ADFS role and DC are in separate machines)

• Windows 2008 R2
• ADFS role added
• Has the following parameters for the ADFS
  • Token signing certificate "sts.staging.spresource.com"
  • Federation Service URI
    • urn:federation:resourceprovider
  • Federation service endpoint url
    • https://sts.staging.spresource.com/adfs/ls/
• Has the following trusted application which is sharepoint
  • https://spadfsweb.spdev.com/_trust/, I have all sort of the combination like below
    • https://spadfsweb.spdev.com
    • https://spadfsweb.spdev.com/_layouts
• Exported the token signing certificate and imported that into account partner ADFS

And below is the steps how I have configured the SharePoint site

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\Data\Certs\stsadfsaccount_exporttokensign.cer")
New-SPTrustedRootAuthority -Name "Account Token Signing Cert" -Certificate $cert
$map = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming
$map2 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" –SameAsIncoming
$ap = New-SPTrustedIdentityTokenIssuer -Name "Staging Provider"-Description "User account domain from adfs to provide authenitcation" -Realm "urn:federation:resourceprovider" -ImportTrustCertificate $cert -ClaimsMappings $map,$map2 -SignInUrl "https://sts.adfsaccount.spaccount.com/adfs/ls/" -IdentifierClaim http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

---SharePoint has the uri of resource provider, signing certificate of the account partner and adfs url of the account partner

Please let me know if I am doing something wrong.

Thanks Deepak

Answer 1

Did you configure SharePoint as the relying party in the "ADFS Account provider"? The "-realm" parameter of the SharePoint New-SPTrustedIdentityTokenIssuer cmdlet should be the identifier of SharePoint in ADFS. That is how ADFS knows who is requesting the token.

Nothing from your resource ADFS should be configured in SharePoint. It only talks with the account ADFS.