- Remove From My Forums
-
Question
-
I have already done several AD FS 3.0 setup in SharePoint 2013 environment to allow trusted Active Directory user to be able to access my SharePoint site. However the most recent setup I’m in charge has not been done due to MSIS7012 error. It would be great
if someone could tell me some potential reasons causing the error belowEncountered error during federation passive request.
Additional Data
Protocol Name:
SamlRelying Party:
Exception details:
Microsoft.IdentityServer.Protocols.Saml.SamlException: MSIS7012: An error occurred while processing the request. Contact your administrator for details.
at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.GetSecurityTokenFromSignInResponse(ProtocolContext context)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.ProcessProtocolRequest(ProtocolContext protocolContext, PassiveProtocolHandler protocolHandler)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)
Thuan Soldier
A 23-year-old man loving Microsoft technologies and making crazy ideas on business journey.
SharePoint Vietnam |
Blog | Twitter
Answers
-
You can solve the error executing from powershell logged in the primary ADFS server the below command:
Set-AdfsProperties -EnableIdpInitiatedSignonPage $true
Regards
La respuesta se proporciona «TAL CUAL», sin garantías y no confiere derechos. Es recomendable probar siempre cualquier sugerencia en un entorno de prueba antes de implementar! This posting is provided «AS IS» with no warranties and
confers no rights! Always test ANY suggestion in a test environment before implementing!-
Proposed as answer by
Tuesday, September 25, 2018 2:22 PM
-
Marked as answer by
Hamid Sadeghpour SalehMVP
Thursday, September 5, 2019 7:56 AM
-
Proposed as answer by
- Remove From My Forums
-
Question
-
I have
a
working SSO (ADFS 2.0 + Application Server with WIF)But I whant to use trusted Token-signing sertificate. I have GoDaddy certificate.
I disable AutoCertificateRollover by running the following from PowerShell:
Add-PSSnapin Microsoft.Adfs.Powershell
Set-ADFSProperties -AutoCertificateRollover $false
Then I added my trusted certificate to AD FS 2.0 Management, and set it Primary
Then I re-enable AutoCertificateRollover:
Add-PSSnapin Microsoft.Adfs.Powershell
Set-ADFSProperties -AutoCertificateRollover $true
I try to go to my applications and I have following error:
There was a problem accessing the site. Try to browse to the site again.
If the problem persists, contact the administrator of this site and provide the reference number to identify the problem.
MSIS7012: An error occurred while processing the request. Contact your administrator for details.
Reference number: 1932e807-24ec-4edc-b583-a5d8721727d8
what I do wrong?
- Remove From My Forums
-
Question
-
I have already done several AD FS 3.0 setup in SharePoint 2013 environment to allow trusted Active Directory user to be able to access my SharePoint site. However the most recent setup I’m in charge has not been done due to MSIS7012 error. It would be great
if someone could tell me some potential reasons causing the error belowEncountered error during federation passive request.
Additional Data
Protocol Name:
SamlRelying Party:
Exception details:
Microsoft.IdentityServer.Protocols.Saml.SamlException: MSIS7012: An error occurred while processing the request. Contact your administrator for details.
at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.GetSecurityTokenFromSignInResponse(ProtocolContext context)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.ProcessProtocolRequest(ProtocolContext protocolContext, PassiveProtocolHandler protocolHandler)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)
Thuan Soldier
A 23-year-old man loving Microsoft technologies and making crazy ideas on business journey.
SharePoint Vietnam |
Blog | Twitter
Answers
-
You can solve the error executing from powershell logged in the primary ADFS server the below command:
Set-AdfsProperties -EnableIdpInitiatedSignonPage $true
Regards
La respuesta se proporciona «TAL CUAL», sin garantías y no confiere derechos. Es recomendable probar siempre cualquier sugerencia en un entorno de prueba antes de implementar! This posting is provided «AS IS» with no warranties and
confers no rights! Always test ANY suggestion in a test environment before implementing!-
Proposed as answer by
Tuesday, September 25, 2018 2:22 PM
-
Marked as answer by
Hamid Sadeghpour SalehMVP
Thursday, September 5, 2019 7:56 AM
-
Proposed as answer by
- Remove From My Forums
-
Question
-
I have already done several AD FS 3.0 setup in SharePoint 2013 environment to allow trusted Active Directory user to be able to access my SharePoint site. However the most recent setup I’m in charge has not been done due to MSIS7012 error. It would be great
if someone could tell me some potential reasons causing the error belowEncountered error during federation passive request.
Additional Data
Protocol Name:
SamlRelying Party:
Exception details:
Microsoft.IdentityServer.Protocols.Saml.SamlException: MSIS7012: An error occurred while processing the request. Contact your administrator for details.
at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.GetSecurityTokenFromSignInResponse(ProtocolContext context)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.ProcessProtocolRequest(ProtocolContext protocolContext, PassiveProtocolHandler protocolHandler)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)
Thuan Soldier
A 23-year-old man loving Microsoft technologies and making crazy ideas on business journey.
SharePoint Vietnam |
Blog | Twitter
Answers
-
You can solve the error executing from powershell logged in the primary ADFS server the below command:
Set-AdfsProperties -EnableIdpInitiatedSignonPage $true
Regards
La respuesta se proporciona «TAL CUAL», sin garantías y no confiere derechos. Es recomendable probar siempre cualquier sugerencia en un entorno de prueba antes de implementar! This posting is provided «AS IS» with no warranties and
confers no rights! Always test ANY suggestion in a test environment before implementing!-
Proposed as answer by
Tuesday, September 25, 2018 2:22 PM
-
Marked as answer by
Hamid Sadeghpour SalehMVP
Thursday, September 5, 2019 7:56 AM
-
Proposed as answer by
Issue symptom
Some of the federated users are not able to sign in Office 365 portal. In ADFS Admin logs see EventID 111 and 364 with following error message:
Protocol Name:
wsfed
Relying Party:
urn:federation:MicrosoftOnline
Exception details:
Microsoft.IdentityServer.RequestFailedException: MSIS7012: An error occurred while processing the request. Contact your administrator for details. —> Microsoft.IdentityServer.Service.SecurityTokenService.ADAccountValidationException: MSIS8006: Query on Active Directory Account for identity ‘XXX’ returned empty attribute values.
There might be two possible root causes of the issue (those I know about so far 😊 ).
1. On premises Active Directory User object or OU the user object is located at has ACL preventing ADFS service account reading the User objects attributes (most likely the List Object permissions are missing).
2. There is an issue with Domain Controllers replication.
For the first one, understand the scope of the effected users, try moving user object to not effected OU and see if the sign in is successful. Compare OU ACLs for working and not working OUs and add missing permissions.
For the second one, start with this article – How To Diagnose Active Directory Replication Failures- https://support.microsoft.com/en-us/help/2498185/how-to-diagnose-active-directory-replication-failures
Содержание
- An error occurred while processing your request, что делать?
- Что такое An error occurred while processing your request
- Как исправить ошибку An error occurred
- Заключение
- An error occurred while processing this request contact your administrator
- Question
- An error occurred while processing this request contact your administrator
- Answered by:
- Question
- Answers
- All replies
- Решение: An error occurred while processing your request
- Error.
- An error occurred while processing your request.
- Answers
- All replies
- ravinjaype
An error occurred while processing your request, что делать?
Ряд пользователей браузеров при переходе на какой-либо сайт (наиболее часто данная проблема встречается на сайте Steam) могут столкнуться с ошибкой и соответствующим сообщением «An error occurred while processing your request». Обновление страницы проблемного сайта обычно ничего не даёт, пользователь сталкивается с упомянутой проблемой вновь и вновь. В этом материале я расскажу, что это за сообщение, при каких условиях появляется данная проблема, и как исправить её на вашем ПК.
Что такое An error occurred while processing your request
В переводе с английского языка текст данной ошибки звучит как «Произошла ошибка во время обработки вашего запроса». Как уже упоминалось выше, наиболее часто на возникновение данной ошибки жалуются пользователи Steam, которые при переходе на данный сайт встречают описанную дисфункцию.
При этом данная ошибка может встречаться и на других ресурсах, и в абсолютном большинстве случаев имеет браузерную основу (пользователи различных онлайн-программ практически с ней не сталкиваются).
Причины данной ошибки следующие:
- Сбой или перегрузка сервера, обрабатывающего ваш запрос;
- Случайный сбой вашего ПК;
- Кэш вашего браузера повреждён;
- Ошибка SSL-сертификата вашего браузера;
- Проблемы с HTTPS-протоколом у ряда сайтов;
- Проблема с HTTPS-расширениями вашего браузера (например, с «HTTPS Everywhere»).
После определения причин дисфункции перейдём к описанию того, как избавиться от ошибки Sorry, an error occurred while processing your request.
Как исправить ошибку An error occurred
Итак, вы встретились с упомянутой проблемой и думаете, как её устранить. Рекомендую выполнить следующий ряд действий:
- Попробуйте просто перезагрузить свой компьютер. Это помогает чаще, чем может показаться;
- Немного подождите. Во многих случаях (особенно это касается пользователей Steam) сервера бывают перегружены или «упали», потому необходимо некоторое время для решения проблемы администрацией сервера. В подобных случаях нужно немного подождать (часто хватает и суток) чтобы проблема была решена;
- Очистите кэш и куки вашего браузера. К примеру, в браузере Мозилла это делается переходом в «Настройки», затем в закладку «Приватность», и кликом на «Удалить вашу недавнюю историю». В открывшимся окне «Удаление истории» в «Подробности» поставьте галочку на «Кэш» и удалите последний;
Заключение
В данном материале мной была рассмотрена тема «An error occurred while processing your request, что делать», обозначены причины данной проблемы и намечены пути её решения. В большинстве случаев данная ошибка возникает из-за перегрузки или «падения» серверов, и от пользователя требуется немного подождать, дабы всё пришло в норму. В иных же случаях попробуйте выполнить очистку кэша вашего браузера, так как именно этот совет оказался весьма эффективным в решении данной проблемы на пользовательских ПК.
Источник
An error occurred while processing this request contact your administrator
Question
I have configured CBA / IFD on my client’s Dynamics CRM 2011 Server and now getting the following error when I try to browse the internal / external url:
Reference
number: 005e0041-36c7-4b2c-9b19-c07a3d071dd9
Certificate is a mulit-domain ucc and added correctly in certificate stores.
The Event Viewer in ADFS is giving the following error:
Microsoft.IdentityServer.Web.RequestFailedException: MSIS7012: An error occurred while processing the request. Contact your administrator for details. —>
Encountered error during federation passive request.
Microsoft.IdentityServer.Web.RequestFailedException: MSIS7012: An error occurred while processing the request. Contact your administrator for details. —> System.ServiceModel.FaultException: MSIS3127: The specified request failed.
at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClientManager.Issue(Message request, WCFResponseData responseData)
at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClient.Issue(RequestSecurityToken rst, WCFResponseData responseData)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)
— End of inner exception stack trace —
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, Uri& replyTo)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, MSISSession& session)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSerializedToken(String signOnToken, WSFederationMessage incomingMessage)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSecurityToken(SecurityToken securityToken, WSFederationMessage incomingMessage)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseForProtocolRequest(FederationPassiveContext federationPassiveContext, SecurityToken securityToken)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponse(SecurityToken securityToken)
System.ServiceModel.FaultException: MSIS3127: The specified request failed.
at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClientManager.Issue(Message request, WCFResponseData responseData)
at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClient.Issue(RequestSecurityToken rst, WCFResponseData responseData)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)
Microsoft Certified Business Management Solutions Specialist
Источник
An error occurred while processing this request contact your administrator
This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.
Answered by:
Question
I have already done several AD FS 3.0 setup in SharePoint 2013 environment to allow trusted Active Directory user to be able to access my SharePoint site. However the most recent setup I’m in charge has not been done due to MSIS7012 error. It would be great if someone could tell me some potential reasons causing the error below
Encountered error during federation passive request.
Exception details:
Microsoft.IdentityServer.Protocols.Saml.SamlException: MSIS7012: An error occurred while processing the request. Contact your administrator for details.
at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.GetSecurityTokenFromSignInResponse(ProtocolContext context)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.ProcessProtocolRequest(ProtocolContext protocolContext, PassiveProtocolHandler protocolHandler)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)
Thuan Soldier
A 23-year-old man loving Microsoft technologies and making crazy ideas on business journey.
SharePoint Vietnam | Blog | Twitter
Answers
You can solve the error executing from powershell logged in the primary ADFS server the below command:
Set-AdfsProperties -EnableIdpInitiatedSignonPage $true
La respuesta se proporciona «TAL CUAL», sin garantías y no confiere derechos. Es recomendable probar siempre cualquier sugerencia en un entorno de prueba antes de implementar! This posting is provided «AS IS» with no warranties and confers no rights! Always test ANY suggestion in a test environment before implementing!
- Proposed as answer by Steve1234599999 Tuesday, September 25, 2018 2:22 PM
- Marked as answer by Hamid Sadeghpour Saleh MVP Thursday, September 5, 2019 7:56 AM
I had this once with a SP that was using another Signing Certificate than the one provided to us in the Federation Metadata XML we received from them. turned out that every time they ran some wizard to adjust their Federation settings a new Signing Certificate was created and used.
Thuan Soldier
A 23-year-old man loving Microsoft technologies and making crazy ideas on business journey.
SharePoint Vietnam | Blog | Twitter
I encountered the same error as yours. It drove me crazy to figure out the reason why. I searched a lot on the Internet and found that the possible reason could be Certificate Chain Validation and Revocation Status Checking in ADFS.
Somehow, due to security policies, your ADFS server is unable to check the Revocation status of the Token Singing Certificate. I realized that if I use the certificate auto generated by AD FS, this error will not happened. However if I disable the AutoCertificateRollover property, and use certificate same as the one for Service Communications, the error will occur. To resolve it, I have to set the SigningCertificateRevocationCheck property as «None» for the relevant Claims Provider Trust or Relying Party Trust.
Источник
Решение: An error occurred while processing your request
Ошибка An error occurred while processing your request. Reference . возникает в программе Steam, во время запуска или же во время выполнения какого-то действия. Ошибка означает, что во время вашего запроса произошла ошибка.
Необходимые действия, которые надо выполнить:
- Убедитесь, что вы используете последнюю версию программы Steam. Перейдите в раздел меню Steam и выберите пункт «Проверить наличие обновлений клиента». Если программа устарела — клиент обновится и ошибка error while processing request больше появляться не будет.
- Вторая по популярности проблема — это перезагруженность серверов. Если у вас актуальная версия и ошибка while processing your request то появляется то исчезает — сервер перезагружен. Попробуйте зайти в программу в другое время.
- Попробуйте обновить MS Visual C++, MS .NET Framework, VCredist. Эти компоненты необходимы для запуска игр и если у вас установлены старые версии, то вполне вероятно ожидать появление ошибок. Подробнее об обновлении читайте ниже.
- Запустите приложение от имени администратора.
Если вы нашли решение проблемы An error occurred while processing your request. Reference . , которое не указано в статье, просим вас помочь сообществу и поделиться решением в комментариях
Источник
Error.
An error occurred while processing your request.
Answers
Open IIS Manager and click on Application Pools. Make sure the Application Pool your MVC app is running under is set to .NET CLR version is 4 and the pipeline mode is Integrated.
Please set the custom errors to false and debug=true in your web.config file to see if it will some specific error message.
No, when client side script has error, the page will still loads. This issue seems like there is some error on the server side.
forgot to tell you that : I am getting this error on landing page..
Open IIS Manager and click on Application Pools. Make sure the Application Pool your MVC app is running under is set to .NET CLR version is 4 and the pipeline mode is Integrated.
I verified both setting are same as mentioned.
ravinjaype
I verified both setting are same as mentioned.
Please provide the entire error message. Perhaps the app is unable to connect to SQL server?
no error detail is coming on page. is there any way to make error show on page?
I verified both setting are same as mentioned.
Go look at the IIS logs.
Maybe you should post to IIS forum.
When you convert the folder to application, there is a button ‘Connect As..’ in the dialog, please check which user you are using and make sure this user has the permission to operate the folders. You can use the Test Settings to check if the current user has the permissions to operate these folders.
Источник
Я борюсь с ошибкой ниже при реализации SAML 2.0 в моем проекте.
Подробности : Сервер : Tomcat IDP: ADFS 2.0
Ошибка :
Exception details:
Microsoft.IdentityServer.Web.RequestFailedException: MSIS7012: An error occurred while processing the request. Contact your administrator for details. --->
System.ServiceModel.FaultException: The creator of this fault did not specify a Reason.
at Microsoft.IdentityServer.Protocols.Saml.Contract.MSISSamlProtocolContractClientManager.ProcessRequest(Message request)
at Microsoft.IdentityServer.Protocols.Saml.Contract.MSISSamlProtocolContractClient.ProcessRequest(MSISSamlRequest samlRequest)
at Microsoft.IdentityServer.Protocols.Saml.Contract.MSISSamlProtocolContractClient.ProcessRequest[T](MSISSamlRequest samlRequest)
at Microsoft.IdentityServer.Protocols.Saml.Contract.MSISSamlProtocolContractClient.Issue(HttpSamlMessage httpSamlMessage, SecurityTokenElement onBehalfOf, String sessionState, String& newSessionState, String& authenticatingProvider)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(HttpSamlRequestMessage httpSamlRequest, SecurityTokenElement onBehalfOf, String& samlpSessionState, String& samlpAuthenticationProvider)
--- End of inner exception stack trace ---
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(HttpSamlRequestMessage httpSamlRequest, SecurityTokenElement onBehalfOf, String& samlpSessionState, String& samlpAuthenticationProvider)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSerializedToken(String signOnToken, WSFederationMessage incomingMessage)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SignIn(SecurityToken securityToken)
System.ServiceModel.FaultException: The creator of this fault did not specify a Reason.
at Microsoft.IdentityServer.Protocols.Saml.Contract.MSISSamlProtocolContractClientManager.ProcessRequest(Message request)
at Microsoft.IdentityServer.Protocols.Saml.Contract.MSISSamlProtocolContractClient.ProcessRequest(MSISSamlRequest samlRequest)
at Microsoft.IdentityServer.Protocols.Saml.Contract.MSISSamlProtocolContractClient.ProcessRequest[T](MSISSamlRequest samlRequest)
at Microsoft.IdentityServer.Protocols.Saml.Contract.MSISSamlProtocolContractClient.Issue(HttpSamlMessage httpSamlMessage, SecurityTokenElement onBehalfOf, String sessionState, String& newSessionState, String& authenticatingProvider)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(HttpSamlRequestMessage httpSamlRequest, SecurityTokenElement onBehalfOf, String& samlpSessionState, String& samlpAuthenticationProvider)
The verification of the SAML message signature failed.
Message issuer: http://XXXXX.XXXX.XXXX.com/adfs/services/trust
Exception details:
MSIS1015: Server required signed SAML AuthenticationRequest but no signature present.
Вот мой декодированный запрос аутентификации:
<?xml version="1.0" encoding="UTF-8"?>
-<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Version="2.0" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" IssueInstant="2014-05-20T05:25:51.083Z" IsPassive="false" ID="_abff2b25141987e9da0f33f30b1180d6" ForceAuthn="false" AssertionConsumerServiceURL="https://inbspg001nfh.as.XXXX.XXXX.com:8443/JavaSamlSP/setcookie.jsp"><samlp:Issuer xmlns:samlp="urn:oasis:names:tc:SAML:2.0:assertion">http://XXXX.XXXX.XXXX.com/adfs/services/trust</samlp:Issuer><saml2p:NameIDPolicy xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" AllowCreate="true"/>-<saml2p:RequestedAuthnContext xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Comparison="exact"><saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml2p:RequestedAuthnContext></samlp:AuthnRequest>
Если у вас есть какие-либо идеи, пожалуйста, помогите мне .. Заранее спасибо ..
2 ответа
Обычно это происходит потому, что ADFS ожидает, что запрос аутентификации будет подписан, а это не так.
Вы можете указать SP подписать запрос и оставить ADFS как есть или указать ADFS не ожидать подписанных запросов. (Для безопасности используйте первое).
Количество способов исправления:
- Установите опцию SP, чтобы подписать Auth. Запрос
- Создайте новые метаданные SP и импортируйте их.
На стороне ADFS:
Для СП:
Set-ADFSClaimsProvider -TargetIdentifier SP-SignedSamlRequestsRequired $False
Все ADFS:
Set-ADFSProperties-SignedSamlRequestsRequired $False
0
rbrayb
20 Май 2014 в 23:56
Получил ошибку MSIS7012 an error occurred while processing the request. Contact your administrator for details.
При дальнейшем расследовании обнаружилась следующая ошибка:
Microsoft.IdentityServer.RequestFailedException: MSIS7012: произошла ошибка при обработке запроса. Свяжитесь с вашим администратором для получения подробной информации. —> System.ArgumentException: ID4216: ClaimType «Namn» должен иметь формат «пространство имен»/«имя». Имя параметра: ClaimType
Выяснилось, что претензии были установлены на шведском языке на английском сервере ADFS. Исправлено путем переименования Namn
в Name
.
0
Ogglas
19 Май 2020 в 16:50
- Remove From My Forums
-
Question
-
Hi,
I have configured CBA / IFD on my client’s Dynamics CRM 2011 Server and now getting the following error when I try to browse the internal / external url:
There was a problem accessing the site. Try to browse to the site again.
If the problem persists, contact the administrator of this site and provide the reference number to identify the problem.
Reference
number: 005e0041-36c7-4b2c-9b19-c07a3d071dd9Certificate is a mulit-domain ucc and added correctly in certificate stores.
The Event Viewer in ADFS is giving the following error:
Microsoft.IdentityServer.Web.RequestFailedException: MSIS7012: An error occurred while processing the request. Contact your administrator for details. —>
Encountered error during federation passive request.
Additional Data
Exception details:
Microsoft.IdentityServer.Web.RequestFailedException: MSIS7012: An error occurred while processing the request. Contact your administrator for details. —> System.ServiceModel.FaultException: MSIS3127: The specified request failed.
at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClientManager.Issue(Message request, WCFResponseData responseData)
at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClient.Issue(RequestSecurityToken rst, WCFResponseData responseData)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)
— End of inner exception stack trace —
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, Uri& replyTo)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, MSISSession& session)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSerializedToken(String signOnToken, WSFederationMessage incomingMessage)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSecurityToken(SecurityToken securityToken, WSFederationMessage incomingMessage)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseForProtocolRequest(FederationPassiveContext federationPassiveContext, SecurityToken securityToken)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponse(SecurityToken securityToken)
System.ServiceModel.FaultException: MSIS3127: The specified request failed.
at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClientManager.Issue(Message request, WCFResponseData responseData)
at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClient.Issue(RequestSecurityToken rst, WCFResponseData responseData)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)
Please help!
Regards,
Zack
Microsoft Certified Business Management Solutions Specialist
Answers
-
Hi Zack,
We got the same issue. This issues is because of the saml 1.0, but we are using saml 2.0 which is adfs 2.0
you need to change the rule for your internal and external replying party trust.
When you create rule transform windows account you need to select *name not name. This resolves the issue. Because *name supports for both saml 1.0 and saml 2.0.
Regards,
Khaja Mohiddin
http://www.dynamicsexchange.com
http://about.me/KhajaMohiddin-
Marked as answer by
Friday, March 2, 2012 11:20 AM
-
Marked as answer by
The scenario is as follows. You provide a custom claims provider for ADFS2.0 so that when user logs-in to the application, the ADFS should offer a list of possible authentication providers. When the custom provider is selected, ADFS redirects the browser to it. Then, ADFS should accept incoming claims and pass them through to the relying party application.
There are plenty of useful scenarios when this could be handy and people blog about it, for example take a look at this article. In one of our projects we go this route, trying to provide a custom STS to support ADFS with various login options (username/password, email/password, uniqueid/password, name.surname/password etc).
What people seem to have problems with is the number of different issues which arise when the ADFS is up to accept and transform incoming claims. One of such common issues show as MSIS7012/MSIS3127 in the event log:
Microsoft.IdentityServer.Web.RequestFailedException: MSIS7012: Wystąpił błąd podczas przetwarzania żądania. Aby uzyskać szczegółowe informacje, skontaktuj się z administratorem. —> System.ServiceModel.FaultException: MSIS3127: Określone żądanie nie powiodło się.
w Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClientManager.Issue(Message request, WCFResponseData responseData)
w Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClient.Issue(RequestSecurityToken rst, WCFResponseData responseData)
w Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)
— Koniec śladu stosu wyjątków wewnętrznych —
w Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)
w Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, Uri& replyTo)
w Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, MSISSession& session)
w Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSerializedToken(String signOnToken, WSFederationMessage incomingMessage)
w Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseForProtocolResponse(FederationPassiveContext federationPassiveContext)
w Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponse(SecurityToken securityToken)
System.ServiceModel.FaultException: MSIS3127: Określone żądanie nie powiodło się.
w Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClientManager.Issue(Message request, WCFResponseData responseData)
w Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClient.Issue(RequestSecurityToken rst, WCFResponseData responseData)
w Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)
If you take a look at the accompanying event log entry you will learn that:
A token was received from a claims provider identified by the key somekeyhere, but the token could not be validated because the key does not identify any known claims provider trust. Key: somekeyhere. This request failed. User Action If this key represents the certificate thumbprint of a claims provider trust, verify that it matches the signing certificate of the claims provider trust in the AD FS configuration database.
It took like 3 hours to finally find the problem. And the problem is the mismatch between the issuer name provided in the provider’s metadata and the issuer name provided in the ADFS configuration.
First one of these two names is set programmatically somewhere in the configuration of the claims provider, in the SecurityTokenServiceConfiguration class:
public class CustomSecurityTokenServiceConfiguration : SecurityTokenServiceConfiguration
{
...
/// <summary>
/// CustomSecurityTokenServiceConfiguration constructor.
/// </summary>
public CustomSecurityTokenServiceConfiguration()
: base( "ADFS Stub",
new X509SigningCredentials( the certificate here )
)
{
this.SecurityTokenService = typeof( CustomSecurityTokenService );
}
}
Note the “ADFS Stub” here – the name is invisible in an explicit form in the metadata because it’s base64’ed somewhere in the certificate description.
The second one of these two names is visible in the explicit form in the ADFS claims trust configuration:
Note that the value of the “Claims provider identifier” attribute (the lower textbox) matches the name provided as the issuer name in the C# code snippet above. If the two do not match you get the exception in the ADFS log.