Troubleshooting AD FS

There are a few things that can cause this problem:

• Verify that all federation servers have a server authentication certificate issued to the default Web site.
  
  
• Verify that all AD FS-enabled Web servers have a server authentication certificate issued to the Web site where the application resides.
  
  
• If there is an external account partner Federation Service Proxy involved, verify that the correct Federation Service host name was used during installation.
  
  
• If you are using a Windows NT token–based application, verify that the Federation Service Uniform Resource Locator (URL) in the Internet Information Services (IIS) Manager snap-in (under <computer name>\Federation Services URL) is configured correctly.
  
  

This issue might be caused by the following configuration problems:

• Verify that the Web application is properly configured in Internet Information Services (IIS).
  
  
• Verify that the Web application URL is properly named in the Active Directory Federation Services snap-in.
  
  
• Verify that Microsoft ASP.NET is installed on the AD FS-enabled Web server and in the Federation Service.
  
  
• If you are connecting to a Windows NT token–based application that uses ASP and you receive the 404 error after supplying your credentials, verify that the ASPClassic handler in IIS is enabled and configured to handle *.asp pages. Verify also that the ASP feature is installed for IIS.
  
  

Verify that the virtual directory of the Windows NT token–based application is set up to use the Ifsext.dll Internet Server Application Programming Interface (ISAPI) extension.

The account federation server uses an authentication package for mapping client certificates. To enable logging for the account federation server authentication package, perform the following tasks in order:

1. If it is not already installed, install the Federation Service component of Active Directory Federation Services (AD FS).
   
   
2. Set the following registry key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\WebSso\Parameters]
   
   "DebugLevel"=dword:ffffffff
   
   

The AD FS Web Agent authentication package is used by Windows NT token–based applications for generating tokens when Service-for-User (S4U) is not available. It is also used when the token contains security identifiers (SIDs), such as in scenarios that use resource groups or the Windows Trust option.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\WebSso\Parameters]

"DebugLevel"=dword:ffffffff

The AD FS Windows Token-Based Agent Extension handles the protocols that are used by AD FS to authenticate requests.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ADFS\WebServerAgent]

"DebugPrintLevel"=dword:ffffffff

The AD FS Web Agent Authentication Service validates incoming tokens and cookies.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IFSSVC\Parameters]

"DebugPrintLevel"=dword:ffffffff

They are located in %systemroot%\SystemData\ADFS\logs.

Solution: Use caution when you create user accounts with the AD LDS ADSI Edit snap-in. Always create a user account with a password. If you create a user account without a password, use ADSI Edit to reset the password for the user account. Most importantly, check the value of the msDS-UserAccountDisabled property of the user account. This property should not have the value True. The value should be either False or Not set. If the value of msDS-UserAccountDisabled property is True, it means that the user account is disabled and the Federation Service cannot validate credentials for this AD LDS user account.

If the Federation Service is running as Local System, you must add the machine account of the computer hosting the Federation Service to the Readers group in the AD LDS store.

If the Federation Service is running as Network Service, you must add the domain account to the Readers group in the AD LDS store.

Error: The token request for the application with URL https://... cannot be fulfilled because the Uniform Resource Locator (URL) does not identify any known trusting application

Solution: This error is returned by the resource Federation Service when the application URL does not identify any known application. Make sure that the application has been added to the trust policy for the Federation Service.

For a claims-aware application, verify that the return URL is typed correctly in the application’s Web.config file and that it matches the application URL that is specified in the trust policy of the Federation Service.

For a Windows NT token–based application, verify that the return URL is typed correctly in the Internet Information Services (IIS) Manager snap-in (under <Web site name>\Authentication\AD FS Windows Token-Based Agent and that it matches the application URL in the trust policy of the Federation Service.

Error: Validation of viewstate media access control (MAC) failed. If this application is hosted by a Web farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm.

AutoGenerate cannot be used in a cluster. An unhandled exception occurred during the running of the current Web request. Review the stack trace for more information about the error and where it originated in the code.

Or

Error: An unhandled exception was generated during the running of the current Web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Solution: Using a text editor, add the following setting to the Web.config file on the computer hosting either the Federation Service, Federation Service Proxy, or AD FS Web Agent that will be farmed:

<system.web>

<machineKey>

<machineKey validationKey="specify key for the appropriate algorithm"

decryptionKey="specify key"

validation="SHA1|MD5|3DES"/>

Or

Solution: Add the following element in the <system.web> section of the Web.config file on the computers hosting the Federation Service, Federation Service Proxy, or AD FS Web Agent that are set up in the farm:

<pages enableViewStateMac="false"/>