Windows Server 2012 R2
ADFS relying party: RPIdentifier
Encryption: The self-signed certificate used for ADFS is imported in the IIS Manager and is used by the service provider to submit the SAML request
Authentication Policies: Enabled both Form and Certificate Authentication
ADFS Service account: service running with an account which is member of the following groups
- Domain Admins
- Domain Controllers
- Domain Users
- Enterprise Admins
- Group Policy Creator Owners
- Schema Admins
- Windows Authorization Access Group
The service provider requests a SAML authentication:
<?xml version="1.0"?> <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_eee714b37b1be43404ba" Version="2.0" IssueInstant="2016-08-09T16:02:21.274Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="https://10.2.0.225/saml" Destination="https://myhost.domain/adfs/ls"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">RPIdentifier</saml:Issuer> <samlp:RequestedAuthnContext xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Comparison="exact"> <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef> </samlp:RequestedAuthnContext> </samlp:AuthnRequest>
The login page appears but as soon as the correct credentials are inserted and submitted an error page appears containing the text:
An error occurred. Contact your administrator for more information.
On the ADFS server the following error appears in the Event Viewer:
MSIS7075: SAML authentication request for the WebSSO profile must not specify any SubjectConfirmations
I took a look here ( paragraph 188.8.131.52 ) and then checked the XML request but I couldn't find any "SubjectConfirmations" tag which is good according to what is specified by the standard.
How can I figure out what is the root cause of the problem ?