| Issue: | Page cannot be displayed on Sso.aspx |
| Resolution | Make sure there is an SSL binding for the website. SSL is required. Check that there is an spid in the query string 404 indicates non spid or an invalid spid. This must be the Service Provider Identifier and can be Url encoded. |
| Issue: | Error processing login request. Invalid Login ID or Password Please Verify and re-enter your login information |
| Resolution | Using the recommended configuration, where SAML Name ID is mapped to User Principal Name by the IdP, the user name will be compared to User Qualified Name (USER_QUALIFIED) and NT Account Name (USER_SAM). Both must equal the User Principal Name, which should be in the form name@domain |
| Issue: | User Import doesn’t seem to work |
| Resolution | User import may fail if the update would result in a duplicate Login ID (USER_ID), User Qualified Name or NT Account Name/Domain |
| Issue: | Could not load file or assembly 'Newtonsoft.Json, Version=4.5.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed' or one of its dependencies |
| Resolution | Add the following to the configuration section of the web.config <runtime> <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1"> <dependentAssembly> <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral"/> <bindingRedirect oldVersion="0.0.0.0-8.0.0.0" newVersion="8.0.0.0"/> </dependentAssembly> </assemblyBinding> </runtime> |
| Issue: | SignatureDescription could not be created for the signature algorithm supplied. |
| Resolution | The secure hash algorithm used for the Relying Party trust is not set to SHA1. ADFS defaults to SHA256, but this is not supported. Change the hash algorithm to SHA1 on the advanced tab of the Relying Party Trust |
| Issue: | Assertion Subject does not define a NameID |
| Resolution | User Principal Name should be mapped to Name ID in the IdP claims configuration |
| Issue: | I can’t see my signing certificate |
| Resolution | Digital certificates must
Core runs under Network Service by default The app pool must have full control of the certificate The friendly name of the certificate should be set to make management easier. SAML connector should now appear in the list of integration connectors: |
| Issue: | Page Cannot Be Displayed Error after logging into authentication server: |
| Resolution | Solution 1: Check that service provider ID in Core matches the SPID in the endpoint url configured in the relying party on the ADFS server This: Should match this: Solution 2: If you have created a new self-signed certificate, make sure that the Relying Party properties have been updated by importing the new certificate (and removing the old one). Export the current certificate: Import new certificate to the relying party and remove the old one: |