SSO Troubleshooting

Issue:

Page cannot be displayed on Sso.aspx

Resolution

Make sure there is an SSL binding for the website. SSL is required.

Check that there is an spid in the query string

404 indicates non spid or an invalid spid. This must be the Service Provider Identifier and can be Url encoded.

Issue:

Error processing login request. Invalid Login ID or Password Please Verify and re-enter your login information

Resolution

Using the recommended configuration, where SAML Name ID is mapped to User Principal Name by the IdP, the user name will be compared to User Qualified Name (USER_QUALIFIED) and NT Account Name (USER_SAM). Both must equal the User Principal Name, which should be in the form name@domain

Issue:

User Import doesn’t seem to work

Resolution

User import may fail if the update would result in a duplicate Login ID (USER_ID), User Qualified Name or NT Account Name/Domain

Issue:

Could not load file or assembly 'Newtonsoft.Json, Version=4.5.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed' or one of its dependencies

Resolution

Add the following to the configuration section of the web.config

<assemblyIdentity name="Newtonsoft.Json"

publicKeyToken="30ad4fe6b2a6aeed" culture="neutral"/>

</dependentAssembly>

</assemblyBinding>

</runtime>

Issue:

SignatureDescription could not be created for the signature algorithm supplied.

Resolution

The secure hash algorithm used for the Relying Party trust is not set to SHA1. ADFS defaults to SHA256, but this is not supported.

Change the hash algorithm to SHA1 on the advanced tab of the Relying Party Trust

Issue:

Assertion Subject does not define a NameID

Resolution

User Principal Name should be mapped to Name ID in the IdP claims configuration

Issue:

I can’t see my signing certificate

Resolution

Digital certificates must

have a private key
must be installed in the local machine certificate store
be accessible to the account running the app pool

Core runs under Network Service by default

The app pool must have full control of the certificate

The friendly name of the certificate should be set to make management easier.

SAML connector should now appear in the list of integration connectors:

Issue:

Page Cannot Be Displayed Error after logging into authentication server:

Resolution

Solution 1:

Check that service provider ID in Core matches the SPID in the endpoint url configured in the relying party on the ADFS server

This:

Should match this:

Solution 2:

If you have created a new self-signed certificate, make sure that the Relying Party properties have been updated by importing the new certificate (and removing the old one).

Export the current certificate:

Import new certificate to the relying party and remove the old one:

PreviousImporting Service Provider metadata into the Identity Provider NextSSL Binding