Sign in
Microsoft.com
 
Microsoft
 
 
 

locked
ADFS Throwing an error RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I have configured CBA / IFD on my client's Dynamics CRM 2011 Server and now getting the following error when I try to browse the internal / external url:

    There was a problem accessing the site. Try to browse to the site again.
    If the problem persists, contact the administrator of this site and provide the reference number to identify the problem.

    Reference
    number:     005e0041-36c7-4b2c-9b19-c07a3d071dd9

    Certificate is a mulit-domain ucc and added correctly in certificate stores.

    The Event Viewer in ADFS is giving the following error:

    Microsoft.IdentityServer.Web.RequestFailedException: MSIS7012: An error occurred while processing the request. Contact your administrator for details. --->

    Encountered error during federation passive request.

    Additional Data

    Exception details:

    Microsoft.IdentityServer.Web.RequestFailedException: MSIS7012: An error occurred while processing the request. Contact your administrator for details. ---> System.ServiceModel.FaultException: MSIS3127: The specified request failed.

       at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClientManager.Issue(Message request, WCFResponseData responseData)

       at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClient.Issue(RequestSecurityToken rst, WCFResponseData responseData)

       at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)

       --- End of inner exception stack trace ---

       at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)

       at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, Uri& replyTo)

       at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, MSISSession& session)

       at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSerializedToken(String signOnToken, WSFederationMessage incomingMessage)

       at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSecurityToken(SecurityToken securityToken, WSFederationMessage incomingMessage)

       at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseForProtocolRequest(FederationPassiveContext federationPassiveContext, SecurityToken securityToken)

       at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponse(SecurityToken securityToken)

    System.ServiceModel.FaultException: MSIS3127: The specified request failed.

       at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClientManager.Issue(Message request, WCFResponseData responseData)

       at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClient.Issue(RequestSecurityToken rst, WCFResponseData responseData)

       at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)

    Please help!

    Regards,

    Zack

    Microsoft Certified Business Management Solutions Specialist

    Thursday, March 1, 2012 3:34 PM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Zack,

    We got the same issue. This issues is because of the saml 1.0, but we are using saml 2.0 which is adfs 2.0

    you need to change the rule for your internal and external replying party trust.

    When you create rule transform windows account you need to select *name not name. This resolves the issue. Because *name supports for both saml 1.0 and saml 2.0.

    Regards,

    Khaja Mohiddin
    http://www.dynamicsexchange.com
    http://about.me/KhajaMohiddin

    Thursday, March 1, 2012 11:03 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Zack,

    We got the same issue. This issues is because of the saml 1.0, but we are using saml 2.0 which is adfs 2.0

    you need to change the rule for your internal and external replying party trust.

    When you create rule transform windows account you need to select *name not name. This resolves the issue. Because *name supports for both saml 1.0 and saml 2.0.

    Regards,

    Khaja Mohiddin
    http://www.dynamicsexchange.com
    http://about.me/KhajaMohiddin

    Thursday, March 1, 2012 11:03 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Also check if ADFS is running open a Browser window and try to reach federationmetadata.xml
    Friday, November 16, 2012 4:36 PM