This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 65%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EG%3C/text%3E%3C/svg%3E)
Sharepoint 2016 and we are trying to integrate with Aure AD and getting the below
errorID4014: A SecurityTokenHandler is not registered to read security token error
D4014: A SecurityTokenHandler is not registered to read security token ('Assertion', 'urn:oasis:names:tc:SAML:2.0:assertion').
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.IdentityModel.Tokens.SecurityTokenException: ID4014: A SecurityTokenHandler is not registered to read security token ('Assertion', 'urn:oasis:names:tc:SAML:2.0:assertion').
Source Error:
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
Stack Trace:
[SecurityTokenException: ID4014: A SecurityTokenHandler is not registered to read security token ('Assertion', 'urn:oasis:names:tc:SAML:2.0:assertion').]
Kindly help for the above .We configured the Identity in Azure AD as urn:sharepoint:site
configured login url =https://login.microsoftonline.com/id of identity/wsfed on sharepoint server
and the certificate Base64
after getting login of azure AD going to sharepoint immediately we will get the error like above
Kindly help to solve the same
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(19.2, 61%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHH%3C/text%3E%3C/svg%3E)
Go get saml 1.1 from azure you have to use the template when you setup the application. search for sharepoint and choose the on premise template.
That template will use a tokenpolicy that is set to use saml 1.1
You can see that by running the command
Get-AzureADServicePrincipalPolicy -Id <ID of app>
and then look at the token policy with command
Get-AzureADPolicy -id <ID from above command> | select id,displayname,definition | ft -autosize -wrap
The tokenpolicy linked to your app should have this info
{{"TokenIssuancePolicy":{"Version":1,"SigningAlgorithm":"http:
//www.w3.org/2001/04/xmldsig-more#rsa-sha256","TokenResponseSi
gningPolicy":"TokenOnly","SamlTokenVersion":"1.1","EmitSamlNam
eFormat":false}}}
We did wrong about this also when we created the app in azure, we did not use the template.
You can also apply the tokenpolicy to your app and it should work
Crazy that its not mentioned in the step by step from MS that everyone refer to...that is a MUST to use the template
Have you followed https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/sharepoint-on-premises-tutorial? Once working, you might also want to look at https://yvand.github.io/AzureCP/.
Thanks for the reply.Really appreciated.
yes i followed same URL https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/sharepoint-on-premises-tutorial
and it did worked for one of the web application and yes we need to use Azure CP like LDAPCP that we will have to configure.
But the issue with another webapplication integrated with another Azure AD other than mentioned above.Looks like (from the articles searched on goolge ) it could be a certificate Problem??Actually we have downloaded base 64 certificate same way as we have done for working webapplication ..only difference for working webapplication , integration is with different azure AD than the non-working web application.
As a best practice, I will convert your answer to a comment.
@Gopan
There is a blog which lists this issue:
Azure AD SAML endpoint will initially only issue SAML 2.0 tokens. This is because the SAML 1.1 issuance policy doesn’t exist for our SSO App Object and will have to be created. You’ll probably see this entry in the ULS logs when this issue occurs
Application error when access /_trust/default.aspx, Error=ID4014: A SecurityTokenHandler is not registered to read security token (‘Assertion’, ‘urn:oasis:names:tc:SAML:2.0:assertion’).
Resolution to this issue is located here where you have to assign the SAML 1.1 token issuance policy to the SSO App Object.
Please have a try and let's know the result.
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
It will take you to same link and we followed the same (and was mentioned by trevorseward) for the configuration and we have ADFS authenitcation too so that users will have option to select ADFS or Azure AD
any clue to this will be higly appreciated
Did you check that?
Yes I mentioned in my initial question we configured the login URL with ID as wsfed instead of saml2 as saml2 is not recognised by Sharepoint
I will research this issue, and reply to you once having any update.
In addition, I converted your answers to comments. If you have any concerns about an answer, you can use Comment to reply. Thanks for your understanding! :)
oops sorry for that ..thanks for correcting ..sure ...noted for future
@Gopan I tested as the official article, it could work well on my environment.
Please run the following to check the settings of your trusted provider:
$trust = Get-SPTrustedIdentityTokenIssuer "AzureAD"
$trust
Note: you need to change the name "AzureAD" to yours.
The result is like:
Thanks a lot ..Very Much Appreciated that you spend time on testing this .Exactly same commands were implemented by us.
Now only thing that we didnot use Azure CP ...htought that initial connection should work and then we can make use of Azure CP as otherwise its difficult to search for people as we have to type in exact external identity to Sharepoint (Believe MS has to improve on that)
Its nothing to do from Azure AD i think so ...mostly its related to Sharepoint.
We added external identity by uaing azure active driectoty and invite guest user once added in Azure AD we add the same account in Sharepoint (of course by typing the same account (UPN) test@Karima ben .com
Lets try with Azure CP and then we will let you know the status.
In our case we have ADFS and now Azure AD
Thansk & Regards
Gops
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(163.2, 10%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDP%3C/text%3E%3C/svg%3E)
Yes SAML 2 is not recongnised for Sharepoint 2016.
SharePoint Server, any current version, only supports SAML 1.1.
Tried again by removing Trusted authority and added again by following the same link provided and its working fine now ...focpurse final fine tuning need Azure CP
Actually the issue was From azure part Sharepoint application was getting added by Our Business partner ..they added Sharepoint Application from market Place instead of selcting Sharepoint on-Premise Application ..so we send the link to be followed and as per the link they added again Sharepoint On-premise application and now its working perfectly fine with SSO
Thanks to all who replied and tested the same from their side.
Answer credit should be to be distributed to both WendyLi-MSFT & Trevorseward.
Extremely sorry ..could not add both as Answers ...it should be for both as WendlyLi-MSFT & Trevorseward...could we do that
Thanks a lot For WendyLi-MSFT as tested from test lab and spend time on the same...
Thansk to all for the replies and guidance hopefully in future too we expect the same response from all of you Guys ..Have a Great day
@Gopan ,
If you like to implement custom solution then you can configure login page and use SPClaimsUtility class to implement the authentication mechanism.
Thanks for that , but Maximum possible we want to avoid Custom Solution.I dont think its a big issue , as almost we reached there but only thing we are getting ID4014 error as mentioned above.Again if you have the guided document for implementing SPClaimsUtility,then it will be more helpful
Thanks Once Again
Sorry about delay in response. Good that you are not going via custom solution. Please ignore my comments as required lots development testing efforts and maintaining solution as well. Kindly let me know your thoughts. Thank you!