0

We have an ADFS server up and running that we use for SSO for Skype in the cloud, which works without an issue. Recently, we've set up a relying party trust with an external partner, who use their own federated service (one that they've written/configured themselves). They are the resource partner and we are the IDP

When trying to access their application, we are hitting their web site but we're unable to log in. In AD FS Admin event log, we see the following 2 events;

Event ID 303 - The federation Service encountered and error while processing the SAML authentication request : MSIS0037: No signature verification certificate found for issuer 'https://xxxxxxxxx.com'

Event ID 364 - Encountered error during federation passive request : MSIS0037: No signature verification certificate found for issuer 'https://xxxxxxxxx.com'

The properties of the relying party trust have SignedSAMLRequestsRequired set to False and SamlResponseSignature set to False.

I'm a little confused as to how to troubleshoot this. I'm assuming that my ADFS server is expecting a signed SAML authentication request but is unable to validate the signature. Could someone explain to me exactly what the identifier does in the RPT configuration?

TIA

migrated from security.stackexchange.com Jun 19 '17 at 16:36

This question came from our site for information security professionals.

0

According to the documentation on Technet for Set-ADFSRelyingPartyTrust, SAMLResponseSignature "[s]pecifies the response signatures that the relying party expects" (and doesn't accept "False" as argument). Thus it won't do what you want it to do (the service is the relying party, not ADFS).

Also, SignedSAMLRequestsRequired means, it will accept unsigned requests and not signed requests whose signatures couldn't be verified.

So, I'd have a look at the certificate used by the service, especially if it is trusted by your ADFS server. My guess is, it's either self-signed or signed by an internal CA.

  • What SAML signing is set on the RP side? Have you imported a signing certificate supplied by the RP? – nzpcmad Jun 19 '17 at 19:20
  • Thanks for the response, PaterSiul. First off, the SAMLResponseSignature is set to AssertionOnly and not False (my error). – Paul G Jun 20 '17 at 14:41
  • This brings me back to one thing that I don't understand. On the RPT in ADFS, I have an identifier set up pointing to one of their sites (https). What role does the identifier and its certificate have the communication process for claims? By this I mean, I have certificates set up for encrypting/decrypting tokens, a certificate for signing tokens and a server communication certificate. When a user/claim is redirected to our ADFS server, with an authentication request token, is the identifier specified in the RPT contacted in any way to check its certificate? – Paul G Jun 20 '17 at 14:43
  • nzpcmad. Thanks for your response as well. I will speak to the RP and get as much information as possible. – Paul G Jun 20 '17 at 14:43
  • The identifier in the response is used by the service provider to verify that the claim it receives is actually for said service provider (and not for some other service the user might have access to). Certificates are used for HTTPS between the user and both the IdP and the SP, for signing the request (by the SP) and for signing the response (by the IdP). Certificates can also be used to encrypt either the request or the response or both, but that's only necessary if you want to keep the information from the user. TLS via HTTPS protects the information from the rest of the world. – PaterSiul Jun 20 '17 at 20:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.