First let me start by saying I feel like this is an easy question, but I am beating my head against the wall on it.
I am trying to get SharePoint 2013 to accept claims from another organization's ADFS environment. So far I have done the following (names replaced where appropriate):
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("partnersts.cer")
New-SPTrustedRootAuthority -Name "Partner ADFS Signing Certificate" -Certificate $cert
$emailClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://sts.company.org/user/EmailAddress" -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming
$fnClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://sts.company.org/user/FirstName" -IncomingClaimTypeDisplayName "FirstName" -SameAsIncoming
$lnClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://sts.company.org/user/LastName" -IncomingClaimTypeDisplayName "LastName" -SameAsIncoming
$groupClaimMap = New-SPClaimTypeMapping -IncomingClaimType "http://sts.company.org/user/Group" -IncomingClaimTypeDisplayName "Group" -SameAsIncoming
$realm = "https://our.local.sharepoint"
$signInURL = "https://sts.company.com/adfs/ls"
$ap = New-SPTrustedIdentityTokenIssuer -Name "Partner ADFS" -Description "Partner Corporate ADFS Provider" -realm $realm -ImportTrustCertificate $cert -ClaimsMappings $emailClaimMap,$fnClaimMap,$lnClaimMap,$groupClaimMap -SignInUrl $signInURL -IdentifierClaim $emailClaimmap.InputClaimType
Everything looks fine when I Get-SPTrustedIdentityTokenIssuer
and Get-SPTrustedRootAuthority
, and I have confirmed through network capture that the certificate matches the certificate being used by the remote provider in the SAML response and that the list of claims supplied matches the list I have mapped. Also the realm, while not urn:something
, is what is being used by the partner and is visible in the SAML response, so that's not the issue. (We had the wrong at first and the error is different in that case anyway.)
However I am getting what apparently is a common message when I try to use the provider:
System.IdentityModel.Tokens.SecurityTokenException: The issuer of the token is not a trusted issuer.
at Microsoft.SharePoint.IdentityModel.SPLocalIssuerNameRegistry.GetIssuerName(SecurityToken securityToken)
at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.CreateClaims(SamlSecurityToken samlSecurityToken)
at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token)
at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ValidateToken(SecurityToken token)
at Microsoft.IdentityModel.Web.TokenReceiver.AuthenticateToken(SecurityToken token, Boolean ensureBearerToken, String endpointUri)
at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequest request)
at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)
at Microsoft.SharePoint.IdentityModel.SPFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs eventArgs)
at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
I know it's not the same issue as The Token Issuer is not a trusted issuer because there's no issue with importing the certificate.
I feel like I'm close but there's something I'm missing. There are a million walkthroughs online including the official one at http://technet.microsoft.com/en-us/library/hh305235(v=office.15) but they are just not getting me there. There's a lot of web hits on the specific error message but so far I don't see any that answer this in my case.