ADFS/IdS Troubleshooting and Common Problems

Cisco IdS log

Cisco IdS logger will log any error that happened in Cisco IdS.

Use RTMT to get Cisco IdS logs. For information on how to use RTMT see, Guide to Use RTMT

Please note that the RTMT name is Cisco Identity Service. In order to find the logs, navigate to Cisco Identity Service > log

Fedlet Logs

Fedlet logs will give more details about any SAML errors that happens in Cisco IdS

Use RTMT to get Fedlet logs.

The location for Fedlet log is same as the Cisco IdS logs.

The fedlet logs start with the prefix fedlet-

Cisco IdS API metrics

API metrics can be used to look into and validate any errors that Cisco IdS APIs may have returned and number of requests that are processed by Cisco idS

Use RTMT to get API metrics.

Please note that the RTMT name is Cisco Identity Service

This will appear under a separate folder metrics. Please note that saml_metrics.csv and authorize_metrics.csv are the relevant metrics for this document.

Event Viewer in AD FS

Allows users to view the event logs in the system. Any error in AD FS while processing the SAML request/sending the SAML response will be logged here.

In AD FS machine, navigate to Event Viewer >Applications and Services Logs >AdDFS 2.0 > Admin

In Windows 2008, launch Event Viewer from Control Panel > Performance and Maintenance > Administrative Tools

In Windows 2012, launch it from Control Panel\System and Security\Administrative Tools.

Please look at your windows documentation to see where to find the Event Viewer.

A SAML Viewer will help in looking at the SAML Request and Response that are sent from/to Cisco IdS.

This browser application is very useful for the analysis of SAML Request/Response.

These are some suggested SAML viewers that you can use for looking at the SAML request and response

AuthCode Request Processing by Cisco IdS

In case of failure, the browser is not redirected to SAML endpoint or AD FS, a JSON error is shown by Cisco IdS, which indicates that the Client Id or Redirect URL is invalid.

Cisco IdS logs- Indicates the errors which occur while the authcode request is validated and processed.

Cisco IdS API metrics - Indicates the number of requests processed and failed.

Client Registration

SAML Request Initiation by Cisco IdS

During failure, the browser is not redirected to AD FS, and an error page/message will be shown by Cisco IdS.

Cisco IdS logs- Indicates whether there is an exception or not while the request is initiated.

Cisco IdS API metrics - Indicates the number of requests processed and failed.

Cisco IdS in NOT_CONFIGURED state.

SAML Request Processing by AD FS

Any failure to process this request will result in an error page being displayed by AD FS server instead of the login page.

Event Viewer in AD FS- Indicates the errors which occur while the request is processed.

SAML Browser Plugin - Helps to see the SAML request which is sent to the AD FS.

Relying Party Trust Configuration in IdP

Sending SAML Response by AD FS

Any failure to send the response results in an error page being displayed by AD FS server after the valid credentials are submitted.

Event Viewer in AD FS - Indicates the errors which occur while the request is processed.

• Relying Party Trust Configuration in IdP
• Form Authentication setting in AD FS.

SAML Response processing by Cisco IdS

Cisco IdS will show a 500 error with the error reason and a quick check page.

Event Viewer in AD FS - Indicates the error if AD FS sends a SAML response without a successful status code.

SAML Browser Plugin - Helps to see the SAML response sent by AD FS to identify what is wrong.

Cisco IdS log - Indicates the  error/exception occurred during the processing.

Cisco IdS API metrics - Indicates the number of requests processed and failed.

• Claim Rules Configuration
• Message and Assertion Signing

Problem Summary

Login request fails with 401 error on the browser.

Error Message

Browser:

401 error with this message: {"error":"invalid_client","error_description":"Invalid ClientId."}

Cisco IdS Log:

Possible Cause

The client registration with Cisco IdS is not complete.

Recommended Action

Navigate to Cisco IdS Management console and confirm if the client is registered successfully. If not, then register the clients before proceeding with SSO.

Problem Summary

Login request fails with 401 error on the browser.

Error Message

Browser:

401 error with this message: {"error":"invalid_redirectUri","error_description":"Invlalid Redirect Uri"}

Possible Cause

User accesses application using IP Address/ Alternate Host Name.

In SSO mode, if the application is accessed using IP, it does not work. Applications should be accessed by the hostname by which they are registered in Cisco IdS. This issue can happen if user accessed an alternate host name that is not registered with Cisco IdS.

Recommended Action

Navigate to Cisco IdS Management console and confirm if the client is registered with the correct redirect URLand the same is used to access the application.

Problem Summary

Login request fails with 503 error on the browser.

Error Message

Browser:

503 error with this message: {"error":"service_unavailable","error_description":"SAML Metadata is not initialized"}

Possible Cause

Idp Metadata is not available in Cisco IdS. Trust establishment between Cisco IdS and AD FS is not complete.

Recommended Action

Navigate to Cisco IdS Management console and see if the IdS is in Not Configured state.

Confirm if IdP metadata is uploaded or not.

If not, upload the IdP metadata downloaded from AD FS.

For more details see here.

Problem Summary

AD FS not showing the login page, instead shows an error page.

Error Message

Browser

AD FS shows an error page similar to this:

There was a problem accessing the site. Try to browse to the site again.

If the problem persists, contact the administrator of this site and provide the reference number to identify the problem.

Reference number: 1ee602be-382c-4c49-af7a-5b70f3a7bd8e

AD FS Event Viewer

The Federation Service encountered an error while processing the SAML authentication request.

Additional Data

Possible Cause

Relying party trust is not established or Cisco IdS certificate has changed, but the same is not uploaded to the AD FS.

Recommended Action

Establish trust between AD FS and Cisco IdS with the latest Cisco IdS certificate.

Please ensure that the Cisco IdS Certificate is not expired. You can see the status dashboard in Cisco Identity Service Management. If so, regenerate the certificate in the Settings page.

For more details on how to establish metadata trust across ADFS & Cisco IdS see, here

Problem Summary

Browser shows NTLM login, and then fails without successfully redirecting to Cisco IdS.

Step of Failure

Sending SAML Response

Error Message

Browser:

Browser shows NTLM login, but after successful log in, it fails with many redirects.

Possible Cause

Cisco IdS supports only form based authentication, Form authentication is not enabled in AD FS.

Recommended Action

For more details on how to enable Form authentication see:

              ADFS 2.0 Form Authentication Setting

              ADFS 3.0 Form Authentication Setting

Problem Summary

Login request fails with 500 error on the browser with Error Code as invalidSignature.

Step of Failure

SAML Response processing

Error Message

Browser:

500 error with this message in the browser:

Error Code: invalidSignature
Message: The signing certificate does not match what's defined in the entity metadata.

AD FS Event Viewer:

No error

Cisco IdS Log:

Possible Cause

SAML Response processing failed as IdP certificate is different from what is available in Cisco IdS.

Recommended Action

Download the latest AD FS metadata from: https://<ADFSServer>/federationmetadata/2007-06/federationmetadata.xml

And upload it to Cisco IdS via the Identity Service Managament user interface.

For details , see Configure Cisco IdS and AD FS

Problem Summary

Login request fails with 500 error on the browser with the status code: urn:oasis:names:tc:SAML:2.0:status:Success

Step of Failure

SAML Response processing

Error Message

Browser:

500 error with this message:

IdP configuration error : SAML processing failed

SAML assertion failed from IdP with status code: urn:oasis:names:tc:SAML:2.0:status:Success. Verify IdP configuration and try again.

Cisco IdS Log

SAML Viewer:

Look for the NotBefore and NotOnOrAfter fields

<Conditions NotBefore="2016-08-28T14:45:03.325Z" NotOnOrAfter="2016-08-28T15:45:03.325Z">

Possible Cause

Time in Cisco IdS and IdP system is out of sync.

Recommended Action

Synchronize the Time in Cisco IdS and AD FS system. It is recommended that AD FS system and Cisco IdS are time synchronized using NTP Server.

Problem Summary

Login request fails with 500 error on the browser with status code:urn:oasis:names:tc:SAML:2.0:status:Responder

 Error Message in AD FS Event View Log – Wrong Signature Algorithm(SHA256 vs SHA1) in AD FS

Step of Failure

SAML Response processing

Error Message

Browser

500 error with this message:

IdP configuration error : SAML processing failed

SAML assertion failed from IdP with status code: urn:oasis:names:tc:SAML:2.0:status:Responder. Verify IdP configuration and try again.

AD FS Event Viewer:
SAML request is not signed with expected signature algorithm. SAML request is signed with signature algorithm http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 .
Expected signature algorithm is http://www.w3.org/2000/09/xmldsig#rsa-sha1

Cisco IdS Log:

Possible Cause

AD FS is configured to use SHA-256.

Recommended Action

Update AD FS to use SHA-1 for signing and encryption.

1. RDP to the AD FS system.
2. Open AD FS console.
3. Select the Relying Party Trust and click Properties
4. Select the Advanced tab.
5. Select SHA-1 from the drop-down list.
   
   

Problem Summary

Login request fails with 500 error on the browser with message "Could not retrieve user identifier from SAML response./Could not retrieve user principal from SAML response."

uid and/or user_principal not set in the outgoing claims.

Step of Failure

SAML Response processing

Error Message

Browser:

500 error with this message:

IdP configuration error : SAML processing failed.

Could not retrieve user identifier from SAML response./Could not retrieve user principal from SAML response.

AD FS Event Viewer:

No error

Cisco IdS Log:

Possible Cause

Mandatory outgoing claims (uid and user_principal) are not configured correctly in the Claim Rules.

If you have not configured the NameID claim rule or either uid or user_principal is not configured properly.

If NameID rule is not configured  or user_principal is not mapped correctly, Cisco IdS indicates that user_principal is not retrieved since this is the property that Cisco IdS looks for.

If uid is not mapped correctly, Cisco IdS indicates that uid is not retrieved.

Recommended Action

Under AD FS claim rules, ensure that attributes mapping for "user_principal" and "uid" are defined as in the IdP Configuration guide(which guide?).

1. RDP to AD FS system.
2. Edit the Claim Rules for the relying party trust.
   
   
3. Verify that the user_principal and uid are mapped correctly

Problem Summary

Login request fails with 500 error on the browser with message "Could not retrieve user identifier from SAML response. or Could not retrieve user principal from SAML response." when the AD FS is a Federated AD FS.

Step of Failure

SAML Response processing

Error Message

Browser

500 error with this message:

IdP configuration error : SAML processing failed

Could not retrieve user identifier from SAML response./ Could not retrieve user principal from SAML response.

AD FS Event Viewer:

No error

Cisco IdS Log:

Possible Cause

In a Federated AD FS there are more configurations required that could be missing.

Recommended Action

Check if the AD FS configuration in Federated AD is done as per the section For a Multi-domain Configuration for Federated AD FS in Configure Cisco IdS and AD FS

Problem Summary

Login request fails with 500 error on the browser with message "Could not retrieve user identifier from SAML response./Could not retrieve user principal from SAML response."

uid and/or user_principal not set in the outgoing claims.

Step of Failure

SAML Response processing

Error Message

Browser

500 error with this message:

SAML assertion failed from IdP with status code: urn:oasis:names:tc:SAML:2.0:status:Requester/urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy. Verify IdP configuration and try again.

AD FS Event Viewer:

The SAML authentication request had a NameID Policy that could not be satisfied.
Requestor: myids.cisco.com
Name identifier format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient
SPNameQualifier: myids.cisco.com
Exception details:
MSIS1000: The SAML request contained a NameIDPolicy that was not satisfied by the issued token. Requested NameIDPolicy: AllowCreate: True Format: urn:oasis:names:tc:SAML:2.0:nameid-format:transient SPNameQualifier: myids.cisco.com. Actual NameID properties: null.

This request failed.

User Action
Use the AD FS 2.0 Management snap-in to configure the configuration that emits the required name identifier.

Cisco IdS Log:

Possible Cause

Custom claim rule is not configured correctly.

Recommended Action

Under AD FS claim rules, ensure that attributes mapping for "user_principal" and "uid" are defined as in configuration guide(which guide?).

1. RDP to AD FS system.
2. Edit the Claim Rules for custom claim rules.
   
   
3. Verify that the AD FS and Cisco IdS fully qualified domain names are given.
   
   

Problem Summary

Login request fails with 500 error on the browser with status code:urn:oasis:names:tc:SAML:2.0:status:Responder

 Error Message in AD FS Event View Log indicates there are too many requests to AD FS.

Step of Failure

SAML Response processing

Error Message

Browser

500 error with this message:

IdP configuration error : SAML processing failed

SAML assertion failed from IdP with status code: urn:oasis:names:tc:SAML:2.0:status:Responder. Verify IdP configuration and try again.

AD FS Event Viewer:

Microsoft.IdentityServer.Web.InvalidRequestException:

MSIS7042: The same client browser session has made '6' requests in the last

'16' seconds. Contact your administrator for details.

   at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.UpdateLoopDetectionCookie()

   at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SendSignInResponse(MSISSignInResponse response)

Cisco IdS Log

Possible Cause

There are too many requests coming to AD FS from the same browser session.

Recommended Action

This should typically not happen in production. But if you encounter this, you can:

1. Check AD FS Windows Event Viewer.
2. Recheck the Relying Party Trust Settings. For more details, see Configure Cisco IdS and AD FS
3. Relogin.

Problem Summary

Login request fails with 500 error on the browser with Error Code:invalidSignature

Step of Failure

SAML Response processing

Error Message

Browser

500 error with this message:

Error Code:invalidSignature
Message:Invalid signature in ArtifactResponse.

Cisco IdS Log:

Possible Cause

AD FS is not configured to sign both Assertion and Message.

Recommended Action

1. Run the AD FS powershell command: Set-ADFSRelyingPartyTrust -TargetName <Relying Party Trust Identifier> -SamlResponseSignature "MessageAndAssertion"
   
2. RDP to AD system.
3. Open Powershell.
4. Add Windows PowerShell snap-ins to the current session. This step may not be required in if you are using ADFS 3.0 since the CmdLet is already installed as a part of adding the roles and features.
   
    
5. Add AD FS Relying party trust for message and assertion.