7

I have to problems left on my dev machine. 1. The Security Token Service is unavailable 2. Get the user profile sync serve started.

I am getting the following error every 5 minutes in my event log after a fresh Sharepoint 2010 Service Pack 2 installation:

Event 8306 (SharePoint Foundation) of severity 'Error' occurred 30 more time(s) and was suppressed in the event log

Looking for similar erros in the event log brought the following line:

Request for security token failed with exception: 
System.ServiceModel.EndpointNotFoundException: Could not connect to 
http://localhost:32843/SecurityTokenServiceApplication/securitytoken.svc/actas. 
TCP error code 10061: No connection could be made because the target machine actively 
refused it 127.0.0.1:32843

I have tried to directly browse to http://localhost:32843/SecurityTokenServiceApplication/securitytoken.svc but Chrome keeps on displaying "the page cannot be displayed"

/EDIT: Changing the url to http://hostname:32843/SecurityTokenxxx..../xxx.svc resulted in a page displayed with the following error:

The server was unable to process the request due to an internal error. For more information about the error, either turn on IncludeExceptionDetailInFaults (either from ServiceBehaviorAttribute or from the configuration behavior) on the server in order to send the exception information back to the client, or turn on tracing as per the Microsoft .NET Framework 3.0 SDK documentation and inspect the server trace logs.

After this I followed the solution posted here: http://blogs.technet.com/b/sykhad-msft/archive/2012/02/25/sharepoint-2010-nailing-the-error-quot-the-security-token-service-is-unavailable-quot.aspx which brought no solution.

Please help me on this one. Kind regards.

//EDIT: Some additional information, which might be useful. The root-site in IIS is Sharepoint Web Services, which runs under the application pool SharePoint Web Services Root. If I click on Basic settings and then on "Test settings..." I am getting 2 green checks.

Moving one layer down, to the SecurityTokenServiceApplication: This one is running under the SecurityTokenServiceApplicationPool. Clicking on test settings here results in an error:

Invalid application path

I have checked, that the managed account that runs the SecurityTokenServiceApplicationPool has valid credentials, is member of the Farm-administrator group and is local administrator.

System specification:

  • Windows Server 2008 R2
  • Sharepoint Server 2010 SP2
  • installed as standalone farm
  • configured via wizard

EDIT2: Progress Thanks to Ali Sharepoint's hints I was able to make some progress, which as of yet did not bring the solution.

In IIS I can test the settings / connection and both come back with a green tick. The Claims service is started and running. The Token Service itself has a status of Online

Yet the errors described above (Connection refused) still persist and I am not able browse the service.

//Update 22.11.13 I am in the process of comparing the settings of one of our productive environments, one of the dev-machines and the failing dev machine. None of the working environments use a specific account fpr the TokenService. Testing the settings there always results in an error. Also the Claims service is disabled and yet the Service is issing tokens.

  • 1
    Are your sharepoint app pools started? One of them might of just stopped. – Hugh Wood Nov 18 '13 at 15:43
  • Yes they are, all of them. – Marco Nov 18 '13 at 15:44
  • Can you provide more details about your configuration? 1) Operating System Version / Edition 2) Authentication Provider - Active Directory or something else 3) SQL Server version 4) Type of installation (looks like single server farm for Dev?) 5) Did you install this server using GUI(Wizard) or PowerShell? 6) How did you configure the service accounts? – kamleshrao Nov 18 '13 at 16:15
  • Is the firewall enabled. Have you tried to open the service directly from the IIS yourserver:83838/SecurityTokenServiceApplication/… please check the correct server name and port with your configuration. – Stefan Bauer Nov 18 '13 at 16:24
  • Stefan Bauer: No the firewall is not enabled. Your second question is already answered in my op. Yes I have tried. No, it only works if I change the hostname. But that does not help, since since it is addressed by the system as hhtp://localhost – Marco Nov 18 '13 at 18:39
9
+50

this could be faulting at several stages!

first place to look even tho you migh of already is look at the app pool, start or recyle "sharepoint webservices root".

now go under sites and start "SharePoint Web Services" right click, manage and then click start or recycle.

now do an iisreset.

if that doesnt work, you could test this one out!

Moving one layer down, to the SecurityTokenServiceApplication: This one is running under the SecurityTokenServiceApplicationPool. Clicking on test settings here results in an error:

change the accout to a farm admin account that has access to that folder ;)

goto this folder location:

C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\WebServices\

right click on SecurityToken and select properties, now goto the security tab. what do you see on the list? do you see the user account that your using within the list?

do you see:

 wss_admin_wpg
 administrators

go under advanced settings for securityTokenServiceAppliction and make sure the user account that is used also has access/valid.

if not add them in! once you have done that, when you do the check again with the selected user account who is part of the administrators group should have access and you should see green tick ;)

EDIT

recreated the same issue:

error same as you enter image description here

changed account to admin account manually enter image description here

works as you can see for the first enter image description here

works for the second ;) enter image description here

EDIT

if all services are running and your still hitting this error than more than likely its todo with the port! make sure its unique and there is no other site using this port number aswell!

also make sure that the service for SecurityTokenServiceApplication, make sure '.net trust level' is set to 'full' trust. todo this click on the service, then under 'asp.net' double click on '.net trust level' and within the drop down select 'full' trust ('full' internal).

next step is to check your security checking on web.config: goto:

%Programfiles%\common files\Microsoft Shared\web server extensions\14\WebServices\SecurityToken

the above is the location of the SecurityTokenServiceApplication web.config that you need to ammend.

goto this line:

      <security authenticationMode="SspiNegotiatedOverTransport" allowInsecureTransport="true" defaultAlgorithmSuite="Basic256Sha256" messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12" />

and change it to this:

      <security authenticationMode="IssuedToken" allowInsecureTransport="true" defaultAlgorithmSuite="Basic256Sha256" messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12" />

iv changed the above from SspiNegotiatedOverTransport to IssuedToken, more can be found here on the subject of types of authentication for wcf:

http://msdn.microsoft.com/en-us/library/aa751836(v=vs.110).aspx

you can also follow this kb article:

http://support.microsoft.com/kb/2493524

EDIT

after reading through the error reported on central admin i could safely assume ;) that its a configuration issue! Have you added any wcf hotfixes??? you would need to. also you need to check on the securityTokenServiceApplicationPool by going to advanced settings! make sure that its targeting framework .net 2.0 and that enable 32 bit application is set to false, you could check against one of your working servers!

If the server is running Windows Server 2008 SP2 then ensure that the hotfix at http://support.microsoft.com/kb/971831 is installed.

If the server is running Windows Server 2008 R2 then the hotfix at http://support.microsoft.com/kb/976462 is installed.

  • 1
    I have already checked, and now double-checked this. The account is called SvcMossTestApp, which has bee around sind SP2007 on all machines. He is in the group WSS_ADMIN_WPG the group, which has Read, Write and Modify rights on this folder. – Marco Nov 19 '13 at 16:02
  • 1
    but did you try what i said above? in iis goto site, click on sharepoint web services, click on securitytokenserviceapplication now click on basic settings, select each one as you did but this time click on connect as and change the account name to a different account! – Ali Jafer Nov 19 '13 at 16:09
  • 1
    i know it works! because iv pulled up the same error as you have! you need to set an account that has access! i used my admin account and both came back green :) – Ali Jafer Nov 19 '13 at 16:10
  • 1
    They come back green, but the browsing still fails and I get an error event in the event log – Marco Nov 19 '13 at 16:13
  • 1
    @serv just updated my answer – Ali Jafer Nov 19 '13 at 16:19
2

Disable loopback check or specify allowed host names. The two methods are described here.

  • 2
    This is already done and a standard procedure in our "SP-install-documentation" – Marco Nov 21 '13 at 8:46
2

This problem indicates that the secure token service application is not functioning correctly. Following could be the possible causes of this problem (see http://support.microsoft.com/kb/2493524):

  1. A required WCF hotfix has not been installed on the SharePoint server
  2. Authentication for the SecureTokenServiceApplication is not configured properly in IIS.
  3. The web.config file of the SecureTokenServiceApplication contains invalid data
  4. The SecureTokenServiceApplication is not provisioned properly.

Depending on the cause of the problem, here are the possible resolutions:

  1. Missing WCF Hotfix: If the server is running Windows Server 2008 SP2, please ensure that the hotfix mentioned at http://support.microsoft.com/kb/971831 is installed. If the server is running Windows Server 2008 R2, the hotfix mentioned at http://support.microsoft.com/kb/976462 must be installed.
  2. Incorrect Authentication Settings: Please ensure that the authentication settings for the SecureTokenServiceApplication are correctly configured by completing the following steps: a) Open IIS Manager b) Expand “Sites” c) Expand “SharePoint Web Services” d) Select “SecurityTokenServiceApplication” e) From the “Features” pane, double click on “Authentication” under “IIS” f) Right click “Forms Authentication” and select “Disable” g) The authentication settings page should only have Windows and Anonymous access enable for the security token service to issue tokens properly (and for claims authentication to work properly)
  3. Incorrect data in the configuration file: Please review the web.config file of the secure token service application and compare it to a web.config file from a "working" secure token service application.
  4. SecureTokenServiceApplication not provisioned: Use the following power shell commands to provision the secure token service application

    $sts = Get-SPServiceApplication | ?{$_ -match "Security"} $sts.Status

  • 1
    Thank you for your reply, but I already did all that. – Marco Nov 12 '13 at 14:13
1

I had the same issue on a server with two IP addresses. I modified the hosts file to point "localhost" to the first IP address (which the STS was bound to), and that solved the problem. I am not a windows systems expert, so I don't know if that is a bad idea for other reasons.

0

I had the same issue it turned out to be a duff username and password for the identity. I recreated the identity and it then worked.

0

for me, the it turned out WWW Publishing Service wasn't started.

0

In my case, I simply re-ran the prerequisite (WcfDataServices) exe explicitly, and it's fixed the issue (so far)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.