1

I'm having a similar problem to this question, using AD FS for SSO (2 ASP.NET sites and a handful of WCFs). On login, users hit a 302 redirect loop, although when the browser stops the loop and the user manually types in the site's URL, their login has completed successfully. I haven't been able to find a trigger for this behaviour, although KB3003381 was recently applied to the system. I have been unable to reproduce this on our test system.

This issue is currently on a production system, so disabling the certificate checks is not an option. This answer mentions a hotfix, but when we applied this to our test system it actually caused the redirect loop to occur!

I'm running AD FS 2.1 on Server 2012. We also have SecurEnvoy providing 2FA.

Sorry for making a new question, but I don't have the rep here to comment. Any help is greatly appreciated!

Improve this question
1

If you have KB2843638/9, then you *must* use KB2896713. You really do want to apply KB3003381, that is perfect.

Turning off the revocation and other checks on signing and encryption certificates is perfect. They were exchanged out-of-band, which makes the key a trusted key. Not checking is actually better :-), the cert is just a (bulky) interoperable transport container for the public key. Self signed is even better.

Improve this answer
4
  • Thanks for the advice - I've got to wait for a maintenance window to put KB3003381 on, I'll let you know what happens... – Mourndark Jan 12 '15 at 11:25
  • I don't expect KB3003381 to help for the loop. But you do need it as a security fix. Do you have KB2896713? And what was the effect of disabling the certificate validation? Is your test environment not identical to production? That would save you a lot of waiting for maintenance windows. – paullem Jan 12 '15 at 17:56
  • Removing KB3003381 stops the loop from occurring. Should I be raising a bug with Microsoft at this point? – Mourndark Jan 21 '15 at 10:42
  • I cannot help you any further this way, because I have almost no information about your loop (applied patches etc.). Someone should take a look at it. Microsoft does offer that service, but 2008R2 is in extendend support (too old). – paullem Jan 21 '15 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.