ADFS communication problem

[Krug, Jeff]

This is not the right list for your question.  You may want to try users at shibboleth.net<mailto:users at shibboleth.net>, as the audience of that list is much broader and would likely have more experience with ADFS and the specific problem you are having.



>From what you posted here it sounds like a problem on the ADFS side though, it may be with the specific configuration of the Shibboleth IdP, but it's an ADFS configuration issue (the warnings you listed below sound like a simple issue of SAML 2 Metadata that may need to be trimmed down to just SAML 2.0 bindings/profiles).  And the exception details sound like a firewall or permissions issue.





________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of giuseppe parisella [gparise2la at gmail.com]
Sent: Friday, January 06, 2012 12:25 PM
To: dev at shibboleth.net
Subject: ADFS communication problem

Hi,
sorry for my english. I'm following the guide Federated Collaboration with Shibboleth 2.0 and SharePoint 2010 Technologies at the site http://technet.microsoft.com/en-us/library/adfs2-step-by-step-guides%28WS.10%29.aspx. So I have 3 virtual machines (one for ADFS, one for Shibboleth and one for Sharepoint2010). I have configured the shibboleth machine as showed in the guide and the status is ok (the https://idmgt-ip0.idmgtext.demo:8443/idp/profile/Status page shows ok). For the ADFS side, the guide doesn't tell anything and so I have followed other documents on the web. Before configure the Sharepoint side, I have to test if it's all right and so, from the ADFS machine, I visit https://sts.idmgt.demo/adfs/ls/IdpInitiatedSignon.aspx (sts.idmgt.demo is the ADFS machine'd alias name) from Internet Explorer and gets out the following error message:

There was a problem accessing the site. Try to browse to the site again.

If the problem persists, contact the administrator of this site and provide the reference number to identify the problem.

MSIS7012: An error occurred while processing the request. Contact your administrator for details.


In the Event Viewer there is a Warning

Trust monitoring service detected changes in policy of 'Shibboleth IdP', but did not automatically apply the changes on the trust partner.

Additional Data
Warnings:
MSIS7524: A 'ArtifactResolutionService' endpoint was ignored because its binding 'urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding' is not supported.
MSIS7524: A 'SamlSingleSignOnService' endpoint was ignored because its binding 'urn:mace:shibboleth:1.0:profiles:AuthnRequest' is not supported.
MSIS7524: A 'SamlSingleSignOnService' endpoint was ignored because its binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign' is not supported.


and 4 Errors with EventID=364:

Encountered error during federation passive request.

Additional Data

Exception details:
Microsoft.IdentityServer.Configuration.ReadServiceConfigFailedException: MSIS2001: Configuration service URL is not configured. ---> Microsoft.IdentityServer.PolicyModel.Client.StorageAuthorizationException: ADMIN0120: The client is not authorized to access the endpoint net.tcp://localhost:1500/policy. The client process must be run with elevated administrative privileges.
   at Microsoft.IdentityServer.PolicyModel.Client.PolicyStoreClientManager.SearchWorker(Filter filter, Int32 maxObjects, String[] propertyNames, Boolean firstTry, PropertyFactoryBase propertyFactory)
   at Microsoft.IdentityServer.PolicyModel.Client.PolicyStoreClientManager.Search(Filter filter, Int32 maxObjects, String[] propertyNames, PropertyFactoryBase propertyFactory)
   at Microsoft.IdentityServer.PolicyModel.Client.PolicyManagerBase.Search[T](Filter filter, Int32 maxItems, String[] properties, PropertyFactoryBase propertyFactory)
   at Microsoft.IdentityServer.PolicyModel.Client.PolicyManagerBase.GetItem[T](Filter filter, String[] properties, PropertyFactoryBase propertyFactory)
   at Microsoft.IdentityServer.Configuration.ServiceConfigurationReader.ReadServiceConfiguration()
   --- End of inner exception stack trace ---
   at Microsoft.IdentityServer.Configuration.ServiceConfigurationReader.ReadServiceConfiguration()
   at Microsoft.IdentityServer.Configuration.ServiceConfigurationReader.get_ServiceConfiguration()
   at Microsoft.IdentityServer.Configuration.ServiceConfigurationReader.GetHostNetTcpPort()
   at Microsoft.IdentityServer.Web.PassivePolicyManager..ctor()
   at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.GetIssuerFriendlyName()

Microsoft.IdentityServer.PolicyModel.Client.StorageAuthorizationException: ADMIN0120: The client is not authorized to access the endpoint net.tcp://localhost:1500/policy. The client process must be run with elevated administrative privileges.
   at Microsoft.IdentityServer.PolicyModel.Client.PolicyStoreClientManager.SearchWorker(Filter filter, Int32 maxObjects, String[] propertyNames, Boolean firstTry, PropertyFactoryBase propertyFactory)
   at Microsoft.IdentityServer.PolicyModel.Client.PolicyStoreClientManager.Search(Filter filter, Int32 maxObjects, String[] propertyNames, PropertyFactoryBase propertyFactory)
   at Microsoft.IdentityServer.PolicyModel.Client.PolicyManagerBase.Search[T](Filter filter, Int32 maxItems, String[] properties, PropertyFactoryBase propertyFactory)
   at Microsoft.IdentityServer.PolicyModel.Client.PolicyManagerBase.GetItem[T](Filter filter, String[] properties, PropertyFactoryBase propertyFactory)
   at Microsoft.IdentityServer.Configuration.ServiceConfigurationReader.ReadServiceConfiguration()


The problem is on this machine or I was wrong something in the Shibboleth configuration?

Thanks

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120106/20e830c2/attachment-0001.html