My knowledge of claims is weak so please forgive me if something doesn't make sense.

When I try to log in to the SharePoint site using claims, I get the error:

Unknown SPRequest error occurred. More information. 0x80070005

Which is an Access Denied error to my understanding.

Fiddler loses all sight of my connection during the SSL tunnel to the TIP, so I get no clues from Fiddler.

The commands I used to set up the TIP are as follows:

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
New-SPTrustedRootAuthority -Name "Vordel Gateway Token Signing Root Authority" 
  -Certificate $cert
$map1 = New-SPClaimTypeMapping 
  -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming
$realm = "urn:myRealm.com"
$signinurl = "https://mySigninURL/sharepointSSO"
$ap = New-SPTrustedIdentityTokenIssuer -Name "Vordel" -Description 
  "Vordel Gateway Issuing SAML Token" -Realm $realm -ImportTrustCertificate 
  $cert -ClaimsMappings $map1 -SignInUrl $signinurl 
  -IdentifierClaim $map1.InputClaimType

After setting up the cert I checked in Central Admin | Security | Manage Trusts and the certificate is there.

I ensured that the Portal Super Reader and Super user accounts had the proper web application user policies applied. Then I ran the following Powershell:

$wa = Get-SPWebApplication -Identity "http://serverName"
$wa.Properties["portalsuperuseraccount"] = "i:0#.w|MyDomain\mySU"
$wa.Properties["portalsuperreaderaccount"] = "i:0#.w|MyDomain\mySR"

When I assign permissions to the site, I can search for users available through the TIP so I know I can hit the provider.

I know that I can see the XML returned by the TIP with all the claim info. The error occurs once the claim is redirected back to SharePoint.

  • 2
    What url are you getting the error at? Should be http://SITE_URL/_trust/. Anything in the ULS logs? Nov 1, 2012 at 20:39
  • I navigate to this address: http://myServer/ SharePoint prompts me to select Windows authenication or my custom provider here: http://myServer/_login/default.aspx?ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F I am redirected to this address (I can see the XML claim [SAML?]) https://mySigninURL/sharepointSSO?wa=wsignin1.0&wtrealm=urn%3amyRealm.com&wctx=http%3a%2f%2fmyServer3%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F Finally, I am redirected here but I get a 500 error. http://myServer/_layouts/Authenticate.aspx?Source=%2F Nov 1, 2012 at 20:58
  • The only thing of any value in the ULS logs is the vague Unknown SPRequest error occurred. More information. 0x80070005 error Nov 1, 2012 at 21:01
  • So I turned on verbose logging, which exposed the following error, PermissionMask check failed. Asking for 0x00010000, have 0x00000000. So I turned on anonymous access just to check. Now I get absolutely no hint of an error in ULS but I still get a 500 error if I try to authenticate via the Vordel provider. Nov 2, 2012 at 15:00
  • 2
    Have you set any kind of User Policy at the web application level (e.g., all users coming in via the Vordel identity provider get Full Read access)? Typically, a permissions issue would manifest itself as the SharePoint "Access Denied" screen and not a generic error page, though. Also, have you tried testing using InPrivate browsing just to ensure there are no interfering cookies? (I have seen HTTP 405 errors when testing sometimes due to that.) Nov 2, 2012 at 15:45

1 Answer 1


It turned out that I did not have all the certificates in the chain and the Vordel Gateway was not pointing back to the correct location. The guys at Vordel were very helpful in fixing this issue!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.