ADFS : ID4175: The issuer of the security token was not recognized by the IssuerNameRegistry

The full error is:

ID4175: The issuer of the security token was not recognized by the IssuerNameRegistry. To accept security tokens from this issuer, configure the IssuerNameRegistry to return a valid name for this issuer.

So there I was happily using my claims-enabled application until one fine autumn morning – WHAM – I get the above error.
WTF?
This error means (to quote Common Windows Identity Foundation WS-Federation Exceptions Explained) that:
“Security tokens are signed by the issuer (the IP-STS). This issuer is validated by the relying party so that the RP can be sure the tokens have been issued from a trusted source. The relying party’s WIF configuration contains an <issuerNameRegistry> element where the settings for the issuer’s signature are stored. This exception means that the configuration contained under the issuer name registry does not match the signature of the security token.”
Then I noticed that my ADFS has certificate rollover enabled and yes – you guessed it – my certificates had rolled over over the weekend.
The section in the web.config looks like:

<issuerNameRegistry type="Microsoft.IdentityModel.Tokens.

ConfigurationBasedIssuerNameRegistry, Microsoft.IdentityModel, Version=3.5.0.0, 

Culture=neutral, PublicKeyToken=31bf3856ad364e35">
        <trustedIssuers>
          <add thumbprint="xxx" name="http://yyy/adfs/services/trust"/>
        </trustedIssuers>
</issuerNameRegistry>

So you need to get the thumbprint of the new ADFS token-signing primary certificate and update the web-config with it.


Enjoy!

WIF : Claims Aware Web Service exception

 

This is with the “Identity and Access Tool” / VS 2012.

When you run the sample and hit Enter, get:

Security negotiation failed because the remote party did not send back a reply in a timely manner. This may be because the underlying transport connection was aborted.

Server stack trace:
   at System.ServiceModel.Security.IssuanceTokenProviderBase`1.DoNegotiation(TimeSpan timeout)

When you click on ClaimsAwareWebService.svc in the Directory Listing, you get:

The service cannot be activated because it does not support ASP.NET compatibility. ASP.NET compatibility is enabled for this application. Turn off ASP.NET compatibility mode in the web.config or add the AspNetCompatibilityRequirements attribute to the service type with RequirementsMode setting as 'Allowed' or 'Required'.

So in the web.config, set this to “false”:

serviceHostingEnvironment aspNetCompatibilityEnabled="true"

All good!

Enjoy!

WIF : Identity and Access Tool

 

This happened a while back but there still seems to be confusion.

This only runs on VS 2012.

Also there have been a lot of changes from WIF 1.0 (3.5) to 4.5. The templates, custom STS, FedUtil etc. are no more. Goodbye to the FederatedPassiveSignInControl and FederatedPassiveSignInStatus controls.

Good summary: What's New in Windows Identity Foundation 4.5

Overview: Windows Identity Foundation Tools for Visual Studio 2012 RTM

Details: Windows Identity Foundation in the .NET Framework 4.5 Beta: Tools, Samples, Claims Everywhere

The Identity Training Kit is no more. Examples are spread across separate samples. The full list is in the third link above.

Enjoy!

ADFS: Certificate Sharing Container

 

If you are wondering where this is in AD (and you are not alone in asking that question), it’s to be found under:

Program Data / Microsoft / ADFS

And I believe that this is only used when you enable AutoRollover.

Enjoy!

Misc: .NET 4.5 / Windows Identity Foundation should include SAMLP support

 

Damn fine idea – 100% agree.

We need full SAML support – ala the old WIF 3.5 CTP.

Vote here: .NET 4.5 / Windows Identity Foundation should include SAMLP support.

And yes – I voted.

Enjoy!

Rant: If you are already in a hole ..

 

Well – YAC – Yet Another Category!

The actual quote is “If you are already in a hole, stop digging”.

I see this every day. We go to a customer, talk about claims-enabled applications. talk about WIF and ADFS, SAML, SSO etc. and the customer is happy.

Then they ask “Actually we’ve got this open-source gateway product that we use. Can ADFS work with it?”. This gateway product is a “sort-of” AM ala TMG, UAG, OpenAM etc.

The correct response is “Sorry, we can’t be experts in every product in the known universe. You probably need to go back to the vendor. We might be able to help but it’s on a ‘best endeavour’ basis – no guarantees”.

The incorrect response is “OK no problem, we’ll check it out”. The customer interprets this as “OK – now it’s your problem”.

Two months later – one pissed-off customer – the guy who wrote the product is somewhere in Siberia – doesn’t answer emails – and we keep on digging the hole deeper.

Tell the customer up front – we are IDENTITY people NOT network people. If they want to get pissed off, well and good – they can find someone else to sort it out!

Enjoy!

ADFS : Using the SAML NameID to map IdP / SP claims

Imagine two companies: Fabrikam and Contuso. Fabrikam has a SaaS application in the cloud that Contuso wants to use. Fabrikam supports SAML authentication and is a SP. Contuso uses ADFS as an IP.

So all the pieces are in place and it should just work no problem. Dream on.

There needs to be a “primary key” that links the two companies together for a session.

Assume Contuso has an employee – the ubiquitous Joe Bloggs - and Joe needs access to the application.

So Contuso has to send Fabrikam a table of users – among which is Joe Bloggs. This table can be sent as XML, xls, text or whatever.

Fabrikam imports these users into the Contuso section of their database.

They also have to agree on what attribute of each user is the primary key e.g. sAMAcountName, email address, AD GUID …

Assume they choose email – this is the NameID.

So when Fabrikam get an AuthNResponse from Contuso, they extract the NameID and use that as the key into their table.

There is one further complication. The SAML spec. allows the NameID to be sent in a number of formats e.g. Unspecified, Email, X509 Subject Name…

This is important. If one side expects the email format e.g. joe.bloggs@contuso.com and the other side is expecting X509 Subject Name e.g. CN=joebloggs@contuso.com, OU=Dev,O=Contuso,C=NZ, you can predict that there will be problems.

So they both have to agree. Assume they choose email address.

To configure this in ADFS:

Configure the email address as the normal “Send LDAP Attributes as Claims”.

Then configure a “Transform an Incoming Claim” rule which takes “Incoming Claim Type” of email and maps it to “Outgoing Claim Type” of NameID which has an “Outgoing NameID Format” of email.

Problem solved!

Enjoy!

ADFS : Getting the domain name as a claim

 

There are a number of ways of doing this.

You can get the domain name via ADFS : Sending groups as claims.

Also there was a thread on the forum that I contributed to viz. Custom Claim Rules - How to write domain name into outgoing claim?.

As I said, you could map msDS-PrincipalName to http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname and then use some regex to split out the domain name.

But further down:

“You don't need to use any mapping/edit LDAP rules and stuff. The windowsaccountname claim is there by default after installing adfs.

Just check it for yourself:

-Open the ADFS 2 console

-Open Trust Relationships

-Open Claims Provider Trusts

-Right mouse click on the AD trust and click "Edit claim rules"

-Note the first rule: Pass through all Windows account name claims.

You can just use the "Pass through or filter an incoming claim option" in the relying party claims configuration and select the windows account name or use a custom transform rule to transform it to the desired outgoing claim.”

Very neat!

Enjoy!

ADFS : New RP / SP metadata for expired certificate

 

Common pattern – you set up a link with a WS-Fed RP or a SAML SP and for whatever reason they use a certificate and it’s expired.

That site has a load of claims rules and it’s a real pain to delete the site, re-import the metadata, type in all the claims rules again etc.

But wait – help is at hand.

Instead of sending you all the metadata, just ask them to send you the certificate as a .cer text file. That’s the format that look like:

-----BEGIN CERTIFICATE-----

<snip>

-----END CERTIFICATE-----

In ADFS, double-click on the RP in the “Relying Party Trust”.

Then click on the Signature tab.

Then click on the “Add” key, browse to the .cer file, select it etc. and viola – you have updated the certificate without having to do the whole nine yards.

Enjoy!

Misc : Damn, I’ve been a busy little elf!

 

Enjoy!

stackoverflow : The forum double

In cricket, we have the concept of the “all-rounder’s double” for cricketers who have scored 1000 runs and taken 100 wickets or whatever.

So I set myself the “forum double” of 10,000 points on stackoverflow and 1,000 points on the Microsoft .NET Framework Forums. It’s a LOT harder to get points on the Microsoft forum – trust me.

This is completely arbitrary but what the hell.

The stackoverflow goal was achieved a while back (refer previous posts) but I’ve just achieved the Microsoft one.



Enjoy!

ADFS : objectGUID as a claim

You may have a business requirement to pass some unique key to the application that is not readily identifiable or editable. There are two possibilities in AD viz. objectSID and objectGUID.

As per SID vs. GUID, objectGUID is the better choice because:

“globally unique identifier (GUID), which is a 128-bit value is unique not only in the enterprise but also across the world”   and
“the values of other object properties can change, but the object-GUID never changes. When an object is assigned a GUID, it keeps that value for life”. 

So you configure the claim in the normal LDAP attribute manner and when you look at the claims, you see:

http://schemas.company.com/identity/claims/objectguid kzGVAByOYki4z7CdR2yecA==
WTF – that ain’t no GUID? The two equal signs at the end would seem to indicate Base64?

Mr. Google to the rescue and viola Issuing objectGUID as an ADFS Claim.

So lets test it out. Couldn’t be bothered to create a VS project just for this so the inestimable LINQPad to the rescue.



And the GUID at the bottom is indeed what is displayed in AD.

Enjoy!