Problems setting up ADFS and Shibboleth

[Caskey, Paul]

Could be several things, but this document from Microsoft should help:

http://www.microsoft.com/download/en/details.aspx?id=5102



From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Steven Barnhart
Sent: Wednesday, December 21, 2011 3:45 PM
To: users at shibboleth.net
Subject: Problems setting up ADFS and Shibboleth

Hello all,

First I'd like to apologize, but I am very new to Shibboleth and am trying to set it up to work with ADFS (v2). From there I followed a guide to set it up with Sharepoint. The idP is on Windows in a test environment connected to Active Directory via the LDAP Connector. I configured Sharepoint to pull the e-mail address and role for the accepted claims. Basically, when I use the following in the attribute-resolver.xml I am successfully redirected to Shiboleth, log in and then am redirected back. Of course, one of the required attributes: e-mail is not sent with this method so Sharepoint eventually complains, but it at least redirects me back:

<resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        ldapURL="ldap://ad.domain.com:3268" baseDN="CN=Users,DC=ad,DC=domain,DC=com" principal="USER at domain.com<mailto:USER at domain.com>"
        principalCredential="PASSWORD">
        <FilterTemplate>
            <![CDATA[
                (sAMAccountName=$requestContext.principalName)
            ]]>
        </FilterTemplate>

        <!-- We rely on the uniqueness of the objectSid.  But it is binary so we *must* make it so -->
        <LDAPProperty name="java.naming.ldap.attributes.binary" value="objectSid"/>
        <!-- If we are following from the GC we need thus on -->
        <LDAPProperty name="java.naming.referral" value="follow"/>

    </resolver:DataConnector>

So, I assume (it was the default) that CN=Users is the Users container, which doesn't actually have the specific account in it directly so some attributes like e-mail and what not are not sent to Sharepoint. So I change it to the following:

<resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        ldapURL="ldap://ad.domain.com:3268" baseDN="DC=ad,DC=domain,DC=com" principal="user at domain.com<mailto:user at domain.com>"
        principalCredential="PASSWORD">
        <FilterTemplate>
            <![CDATA[
                (sAMAccountName=$requestContext.principalName)
            ]]>
        </FilterTemplate>

        <!-- We rely on the uniqueness of the objectSid.  But it is binary so we *must* make it so -->
        <LDAPProperty name="java.naming.ldap.attributes.binary" value="objectSid"/>
        <!-- If we are following from the GC we need thus on -->
        <LDAPProperty name="java.naming.referral" value="follow"/>

    </resolver:DataConnector>

And then I get a general ADFS error message (i.e., it doesn't redirect me *at all* to Sharepoint). In the Windows ADFS logs I get the following:

Encountered error during federation passive request.

Additional Data

Exception details:
Microsoft.IdentityServer.Web.RequestFailedException: MSIS7012: An error occurred while processing the request. Contact your administrator for details. ---> System.ServiceModel.FaultException: ID3242: The security token could not be authenticated or authorized.
   at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClientManager.Issue(Message request, WCFResponseData responseData)
   at Microsoft.IdentityServer.Protocols.WSTrust.WSTrustClient.Issue(RequestSecurityToken rst, WCFResponseData responseData)
   at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)
   --- End of inner exception stack trace ---

Token validation failed. See inner exception for more details.

Additional Data

Exception details:
ID4152: The Saml2SecurityToken cannot be validated because the IssuerToken property is not set. Unsigned SAML2:Assertions cannot be validated.

This request failed.


I am probably not providing all the information that would be helpful, but I'll do my best to gather anything needed. The idp-process.log seems to successfully send it - 16:20:57.084 - DEBUG [org.opensaml.ws.message.encoder.BaseMessageEncoder:56] - Successfully encoded message.

Thanks in advance for whoever can help.

Steven Barnhart
Systems Specialist
Enrollment Services & Undergraduate Education
The Ohio State University
sbarnhart at esue.ohio-state.edu<mailto:sbarnhart at esue.ohio-state.edu>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111221/44293913/attachment-0001.html