We have an issue with ADFS and Azure ADConnect authentication on our network. We can sign in and use Office365 systems no problem at all, and ADFS redirect works perfectly when using our Office365 online portal.
When we try to login to an MSDN subscription (in this example through VisualStudio connecting to external Azure web apps etc.) or connect to Azure using Powershell with Login-AzureRmAccount, we get 'an error occurred' and eventID 364 logged in the ADFS server event viewer logs, 'Encountered an error during federation passive request'
Encountered error during federation passive request.
Additional Data
Protocol Name: wsfed
Relying Party: urn:federation:MicrosoftOnline
Exception details: Microsoft.IdentityServer.Service.Policy.PolicyServer.Engine.InvalidAuthenticationTypePolicyException: MSIS7102: Requested Authentication Method is not supported on the STS. at Microsoft.IdentityServer.Web.Authentication.GlobalAuthenticationPolicyEvaluator.EvaluatePolicy(IList`1 mappedRequestedAuthMethods, AccessLocation location, ProtocolContext context, HashSet`1 authMethodsInToken, Boolean& validAuthMethodsInToken) at Microsoft.IdentityServer.Web.Authentication.AuthenticationPolicyEvaluator.RetrieveFirstStageAuthenticationDomain(Boolean& validAuthMethodsInToken) at Microsoft.IdentityServer.Web.Authentication.AuthenticationPolicyEvaluator.EvaluatePolicy(Boolean& isLastStage, AuthenticationStage& currentStage, Boolean& strongAuthRequried) at Microsoft.IdentityServer.Web.PassiveProtocolListener.GetAuthMethodsFromAuthPolicyRules(PassiveProtocolHandler protocolHandler, ProtocolContext protocolContext) at Microsoft.IdentityServer.Web.PassiveProtocolListener.GetAuthenticationMethods(PassiveProtocolHandler protocolHandler, ProtocolContext protocolContext) at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)
We have a single ADFS 3.0 server utilising Azure ADConnect to sync our on-premise AD to Office365. The correct Office365 identity server entry is present in our ADFS configuration.
For some reason we can't authenticate MSDN accounts and logging into Azure through powershell seems to fail the same way. S smaller window with a Microsoft account login appears, then we should redirect to our ADFS authentication page but fails. We can login to the web based Azure portal no problems with domain credentials.
I've seen a couple of similar threads, one mentioned to run through the ADFS configuration wizard again, although if there's any more troubleshooting steps to look into that would be really helpful.
