We've been setting up a SharePoint 2013 farm in a lab environment here and have hit a very odd issue with Claims authentication via ADFS. The issue is when a user connects to the SharePoint site they are appropriately redirected to the ADFS host, and after a successful sign in they are redirected back to SharePoint. That all appears to work correctly. The strange part is when they hit the SharePoint site it immediately redirects them back to the ADFS provider, who then bounces them back to SharePoint and back and forth until ADFS throws an error for too many requests within one minute.
We've followed the same configuration that has been successful for us a number of times in SharePoint 2010 and on one other SharePoint 2013 farm. We've tried two different ADFS providers with the same result. We've rebuilt the SharePoint server no fewer than 4 times all the way from a reformat of the drive and a complete re-install, with no change.
My question is: what could be causing this issue and what did we miss in the configuration?
The SharePoint Server is a VM with 12 GB of RAM and 4 Processor Cores - more than enough for a development environment methinks. The ADFS provider is set to up with the normal [sharepointhost]/_trust/ endpoint and we are sending both email and role claims, with email as the identifier. Again, this set up has worked on a number of other SharePoint servers for us; but for some reason this one is unhappy with it.
I've been up and down the ULS logs and these lines are what I see most often during this logon failure loop that I think are key:
STS Call Claims Saml: Successfully requested sign-in claim identity on behalf of user 'email@example.com'. ... Non-OAuth request. IsAuthenticated=True, UserIdentityNamefirstname.lastname@example.org, ClaimsCount=16 ... Token Cache: Failed to get token from distributed cache for 'email@example.com'.(This is expected during the process warm up or if data cache Initialization is getting done by some other thread). Token Cache: Reverting to local cache to get the token for 'firstname.lastname@example.org'. security token 'email@example.com_Internet' is found in the local cache, but it is expired. Returing Null.. Non-OAuth request. IsAuthenticated=False, UserIdentityName=, ClaimsCount=0
It looks to me like the login is successful, then when the next request for authorization comes SharePoint looks in the cache and can't find the user, then it tries the local cache and fails again, then it gives up and returns null - which kicks off another request to ADFS for an updated identity. This repeats until ADFS halts the process.