Home / server / Questions / 819124
In Process
GaryF
Asked: 2016-12-07 13:02:45 +0800 CST

Cannot login to ADFS from service provider

  • 772

Scenario

  1. User on AD client machine opens a browser and enters a https url to a service provider.

  2. Browser redirects to ADFS 3.0 IdP and the user is prompted to enter their AD user name and password.

  3. Browser redirects to the SP url and back to IdP six times until the following error is returned.

For a standard AD user

Activity ID: 00000000-0000-0000-1f00-0080000000f9
Relying party: SAM6
Error time: Thu, 01 Dec 2016 10:38:48 GMT
Cookie: enabled
User agent string: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0)
Gecko/20100101 Firefox/49.0

If the AD user attempts to login the following error appears

Activity ID: 00000000-0000-0000-1f00-0080000000f8
Relying party: SAM6
Error time: Thu, 01 Dec 2016 10:38:48 GMT
Cookie: enabled
User agent string: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0)
Gecko/20100101 Firefox/49.0

Google doesn't return any reports for these errors posting here to see if anyone has encountered these errors. Related results returned by Google have been checked.

adfs saml

1 Answers

  1. Discovered what the issue was, once a user attempted to log into the relying party trust server it began the SAML login procedure, and authenticated the user. However as part of the authentication process on the relying party trust server a id file needed to be accessed, which was causing another SAML assertion to be generated, once this requirement was removed the issue was resolved.

    • 0