ADFS 2.0 - request token for service in different AD - certificate

I have the following scenario:
Active Directory 1: WCF Client, ADFS 2.0 (STS)
Active Directory 2: WCF service (Relying Party)
I have added the RP to the ADFS but when I request a token from the ADFS I recieve the following error: System.ServiceModel.FaultException: ID3242: The security token could not be authenticated or authorized.
Looking at the event log of the ADFS I find the matching error:
An error occurred during an attempt to build the certificate chain for
the relying party trust 'http://XXXXX/Service1/' certificate
identified by thumbprint 'XXXXXXXXXXXX'. Possible causes are that the
certificate has been revoked, the certificate chain could not be
verified as specified by the relying party trust's encryption
certificate revocation settings or certificate is not within its
validity period.
You can use Windows PowerShell commands for AD FS 2.0 to configure the
revocation settings for the relying party encryption certificate.
Relying party trust's encryption certificate revocation settings:
CheckChainExcludeRoot The following errors occurred while building
the certificate chain: Unknown error. Unknown error.
User Action: Ensure that the relying party trust's encryption
certificate is valid and has not been revoked. Ensure that AD FS 2.0
can access the certificate revocation list if the revocation setting
does not specify "none" or a "cache only" setting. Verify your proxy
server setting. For more information about how to verify your proxy
server setting, see the AD FS 2.0 Troubleshooting Guide
(http://go.microsoft.com/fwlink/?LinkId=182180).
Looks like the ADFS does not trust the signing certificate from the RP (understandable, the CA which issued the Signing certificate is in a different AD).
The CertificateRevokationList is reachable from both Active Directories.
I have added the CA certificate to the Trusted Root Certificates of the "Local Computer", but I think the problem is the validation mechanism.
What do I have to configure to get the ADFS to issue a token signed with the proper certificate or how can I convince the ADFS that the certificate is valid?
EDIT:
I have tried changing the revokation check with the powershell command:
Set-ADFSRelyingPartyTrust -SigningCertificateRevocationCheck CheckEndCert
but with no luck:
Set-ADFSRelyingPartyTrust : Parameter set cannot be resolved using the specified named parameters.
At line:1 char:26
+ Set-ADFSRelyingPartyTrust <<<< -SigningCertificateRevocationCheck CheckEndCert
+ CategoryInfo : InvalidArgument: (:) [Set-ADFSRelyingPartyTrust], ParameterBindingException
+ FullyQualifiedErrorId : AmbiguousParameterSet,Microsoft.IdentityServer.PowerShell.Commands.SetRelyingPartyTrustC
ommand
EDIT 2:
This worked:
(Get-ADFSRelyingPartyTrust) | Set-ADFSRelyingPartyTrust -EncryptionCertificateRevocationCheck CheckEndCert
but now my client in Active Directory 1 complains about the certificate...
System.ServiceModel.Security.SecurityNegotiationException: SOAP
security negotiation with
'http://XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/Service1/' for target
'http://XXXXXXXXXXXXXXXXX/Service1/' failed. See inner exception for
more details. --->
System.IdentityModel.Tokens.SecurityTokenValidationException: The
X.509 certificate CN=RP-Service chain building failed. The certificate
that was used has a trust chain that cannot be verified. Replace the
certificate or change the certificateValidationMode. A certificate
chain could not be built to a trusted root authority.

Maybe you should try to add your RP-Service cert into Trusted People store on the machine, where your WCF client runs. That was what I did when using self-signed cert to test WCF call under federation with ADFS.

I'm facing the same error. What helps is using
Set-ADFSRelyingPartyTrust -EncryptionCertificateRevocationCheck None
But this will only disable the check on the RP part. Since we're talking about federation the same will happen on the federated server. So you have to do it there too. Anyways, it only changed the errors i get - i still can't federate ATM.

The command that works for me is this:
Set-ADFSRelyingPartyTrust -TargetName <relyingpartytrustName> -EncryptionCertificateRevocationCheck None
We have several times, resulted to installing the signing and encryption certificates (self-signed certs generated by ADFS) everywhere (i.e. the servers hosting the WCF services).

Related

Having RevocationValidationException while integrating ADFS with service provider although the certificate is valid?

I am receiving an exception on ADFS while integrating private.xyz.com. The exception says.
Microsoft.IdentityServer.Service.SecurityTokenService.RevocationValidationException: MSIS3015: The signing certificate of the claims provider trust 'https://private.xyz.com/sp' identified by thumbprint '****************************' is not valid. It might indicate that the certificate has been revoked, has expired, or that the certificate chain is not trusted.
at Microsoft.IdentityServer.Service.Tokens.MSISX509SecurityToken.MatchesKeyIdentifierClause(SecurityKeyIdentifierClause keyIdentifierClause)
at System.IdentityModel.Tokens.SecurityToken.ResolveKeyIdentifierClause(SecurityKeyIdentifierClause keyIdentifierClause)
at
The signing certificate is configured in the relying party trust
Get-AdfsRelyingPartyTrust "private" | fl name,RequestSigningCertificate
The thumbprint which I am getting for the certificate is same what I am getting in the error message. And the certificate is also not expired.
What all do I need to configure so I can resolve this?
If the certificate has not been revoked or is still current, it is usually because ADFS can't locate the certificate revocation list on the Internet. You can turn this off via PS.
Also, it could be that the intermediate certificates aren't loaded into the certificate store or that the certificate itself is not trusted.
You could manually add it to Trusted Certificates.

Fabric access with client certificate auth fails

We're using Fabric secure cluster and need client certificate for CI/CD tools.
I've created both Cluster primary certificate and client certificate with this script https://gist.github.com/kagarlickij/d63a4061a1066d3a85abcc658f0856f5
so both have been uploaded to the same Kay vault and both have been installed to local keystore on my machine.
I've added client certificate to my Fabric security settings (Authentication type = Admin client, Authorization method = Certificate thumbprint).
The problem is that I can connect (I'm using Connect-ServiceFabricCluster in PowerShell) to Fabric cluster with Cluster primary certificate but can't with Client certificate.
I'm getting this error: Connect-ServiceFabricCluster : FABRIC_E_SERVER_AUTHENTICATION_FAILED: 0x800b0109
Please advice what can be done?
Based on this link the corresponding error code for 0x800b0109 is:
A certificate chain processed, but terminated in a root certificate
which is not trusted by the trust provider.
You're using a self-signed certificate as client cert. I'm not sure it's supported as explained in the Service Fabric Security documentation, moreover you'll have to make sure the SSL certificate has been added inside your local Store.
Client X.509 certificates
Client certificates typically are not issued by a third-party CA.
Instead, the Personal store of the current user location typically
contains client certificates placed there by a root authority, with an
Intended Purposes value of Client Authentication. The client can use
this certificate when mutual authentication is required. Note
All management operations on a Service Fabric cluster require server certificates. Client certificates cannot be used for management.
I had the same issue managing my cluster through powershell, I only had 1 cert on the cluster (the one azure generates when creating the cluster) and I believe it is a client cert since I have to select it in my browser when managing the cluster.
Ultimately I had to add the self signed cert to my Root certificate store (in addition to my personal store where I already had it) to get the powershell module to stop complaining about it.

ADFS Claims Trust Provider with expired certificate

Hi I have multiple IDPs registered under our ADFS Claims Trust Provider. One of the IDP's federation metadata has expired certificate. Corresponding party has successful integration (with expired certificate) with other 3rd party Service Provider (non MS platform). So basically I was told to integrate this IDP with expired certificate under our ADFS SP.
Now every time when User from this IDP logs in and try to get redirected via ADFS we get following error in event log.
An error occurred during an attempt to build the certificate chain for the claims provider trust 'https://xyz.com/opensso' certificate identified by thumbprint 'D13412341231312312311231313123'.
Possible causes are that the certificate has been revoked, the certificate chain could not be verified as specified by the claims provider trust's signing certificate revocation settings or certificate is not within its validity period.
You can use Windows PowerShell commands for AD FS to configure the revocation settings for the claims provider trust's signing certificate.
Claims provider trust's signing certificate revocation settings: None
The following errors occurred while building the certificate chain:
MSIS2013: A required certificate is not within its validity period when verifying against the current system clock.
User Action:
Ensure that the claims provider trust's signing certificate is valid and has not been revoked.
Ensure that AD FS can access the certificate revocation list if the revocation setting does not specify "none" or a "cache only" setting.
Verify your proxy server setting. For more information about how to verify your proxy server setting, see the AD FS Troubleshooting Guide (http://go.microsoft.com/fwlink/?LinkId=182180).
I already tried following cmdlets but no success so far.
Set-ADFSClaimsProviderTrust -TargetName "ABC Test" -SigningCertificateRevocationCheck "None"
Set-ADFSClaimsProviderTrust -TargetName "ABC Test" -EncryptionCertificateRevocationCheck "None"
We are using ADFS 3.0 in farm setup. Is it really possible to use Claims Identity Provider with expired certificate?
Thanks
No - it's not.
All based on trust and if the certificate has expired so has the trust.
The commands that you are running are simply telling ADFS not to verify the validity of the certificate in terms of the CA signing authority.
There is no command to unexpire a certificate - you need to get a new, valid one.
And that's the way it should it should be from a security PoV.

REST Service - SSL Implementation (HTTP Error 403.7 - Forbidden)

In order to secure my Rest Services, I have enabled SSL in IIS and Created a Self-Signed Certificate and assigned it to the HTTPS binding in IIS. I exported the same as pfx file and added the same in IE also but when I try to access the Services, I get the following error on Windows 7, Enterprise edition
HTTP Error 403.7 - Forbidden
The page you are attempting to access requires your browser to have a Secure Sockets Layer (SSL) client certificate that the Web server recognizes.
And on Windows Server 2003, this is
HTTP Error 403.7 - Forbidden: SSL client certificate is required.
Internet Information Services (IIS)
I am not sure what shall I do except adding the certificate in IE under “Personal” and “Trusted Root Certification Authorities”? Could you please suggest me some step, in order to make this work.
Note: I have tried with “Self-Signed Certificates” as well as with Certificates generated from Microsoft “Certificate Services” also.
Any help is greatly appreciated.
SSL is used to verify the identity of the server, not the identity of the client. The error suggests (http://support.microsoft.com/kb/199215, "This is used for authenticating you as a valid user of the resource. ") the server wants to identify the client. Which of the two are you trying to do?
Edit: SSL requires the public part of the SSL certificate to be available to the client. Adding it to the trusted root certificates seems to me to be the only way to make the public part of a self-signed certificate available to the browser.

Lync Server Deploy Certificate Verification Failed

Just got my Lync server deployed on Windows Server 2008 R2 and am trying to connect via Lync client on a different machine. When attempting to sign in, the client throws an error saying "Cannot sign in to Lync: There was a problem verifying the certificate from the server.".
Looking deeper, into the client box's event viewer, I see the following error "The certificate received from the remote serer was issued by an untrusted certificate authority. Because of this, none of the data contained in the certificate can be validated. The SSL connection request has failed. The attached data contains the server certificate. ....
My organization has an internal CA, which is in charge of issuing all required certificates to the Lync server. My client box has installed the internal CA (root) as a trusted CA provider. To me, this should cause any certificates that issues, including the Lync certificates, to be trusted.
I installed Lync client on the same box that Lync server is hoted, and am able to log in fine. My error only occurs when connecting from a different box.
Can anyone shed some light? Thanks!
I had same issue. To resolve: from client, hit url of CA Authority, some thing like http://CAservername/certsrv this provided option to download a CA Certificate Chain.
Put this into local computer trusted root certs and I was good to go.
As mentioned in the error message ("Cannot sign in to Lync: There was a problem verifying the certificate from the server"), this is clearly a certification error. If you work in a big company (where they have they own internal CA - (Certification Authority)) in most cases they would have used their internal certificate to establish trust relationship. If you just install/export the Root certificate of the CA under "Trusted Root Certificate Authorities” of “Local Computer” account, this error should be resolved.
If your company doesn't have own CA, then find our who issued the certificate for Lynch and install/export the root certificate of that CA to the same location as above, this issue should be resolved.