Certificate validation error (AADSTS50017) in macOS Teams 24193.1707.3028.4282

Warren 0

Version 24193.1707.3028.4282 of MS Teams (newest as of 30 Aug 2024) now won't successfully validate my PIV card when 1) it's worked previously, and 2) it's working right now via the web as I'm successfully logged-in to work via Firefox, Chrome, MS Teams, and Safari.

Warren 0 Reputation points

2024-09-01T07:10:07.14+00:00

Also now getting this error: "Message: AADSTS1001009: No value in the certificate, as requested by tenant policy, is able to validate the user claim." I have also rebooted, restarted MS Teams, deleted and re-installed MS Teams.
Warren 0 Reputation points

2024-09-02T21:34:19.7866667+00:00

Also: Also cannont authenticate into my OneDrive MS Word document using the MS Word native app on my MBP laptop. Yet, I can, like with Mail, properly authenticate with online Word. So it appears to be a central mechanism that WORKS with online browsers, but NOT with MS apps on macOS. Yet they all used to just last week.

1 answer

Robin Sheng-MSFT 3,760 Reputation points Microsoft Vendor

2024-09-02T06:40:24.97+00:00
Hi @Warren

According to our official documentation, you encountered a CertificateValidationFailed error.

Please try to contact your tenant administrator to ensure that your certificate is available, configured correctly and contains all the necessary values required by the tenant policy, or update and reissue the certificate with the correct information.

You can also try the following steps to troubleshoot the problem locally:

Clear the Teams cache:

Check the certificate and PIV card: Make sure your PIV card and related certificates are up to date and have not expired. You can try to reinsert the PIV card or use another USB port.

Until the problem is resolved, you need to temporarily use the web version of Teams as an alternative.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Warren 0 Reputation points

2024-09-02T21:14:32.5233333+00:00

Thank you for responding.

PIV authentication still doesn't work within MS Teams (24215.1002.3039.5089) while it continues to work successfully via the browser (including Safari, Firefox, Edge, and Chrome) on my MBP14,6 on macOS Sonoma 14.6.1 (23G93).

I'm successfully using my PIV card for web-based authentication I think it's safe to say the certificates are not the problem. Nonetheless I checked and the earliest any certificate will expire is May 2025.

I followed your instructions (thank you) for clearing the cache. No joy.

I completely erased I reinstalled the app - no joy.

Interestingly, since first starting this bug report the MS Teams version has changed from 24193.1707.3028.4282 to 24215.1002.3039.5089.

Robin Sheng-MSFT 3,760 Reputation points Microsoft Vendor

2024-09-03T03:27:31.3866667+00:00

Hi @Warren
We are sorry to hear that this has had a negative impact on your work. You may need to log in to the Microsoft 365 admin center to report the problem.

In the meantime, please use the web version as an alternative. If there is anything else we can help you with, please feel free to contact us.

Warren 0 Reputation points

2024-09-03T06:59:33.0066667+00:00

Thank you, Robin. How do I make a report from macOS Sonoma?

Robin Sheng-MSFT 3,760 Reputation points Microsoft Vendor

2024-09-03T07:41:46.25+00:00

Hi @Warren
You may need to log in as an administrator through Safari. https://admin.microsoft.com/#/homepage

Or try contacting phone support:

Find support phone numbers by country or region

Warren 0 Reputation points

2024-09-03T08:21:14.1933333+00:00

Thank you, Robin.

Warren 0 Reputation points

2024-09-03T18:02:36.68+00:00

Robin - I think I found the answer. I was able to successfully create a new account on my computer, and re-loaded my MS apps as if I were starting fresh on a new computer. I got into my corporate email no problem, like before. While logging in to my MS Word, though, I was re-challenged for my PIV credentials and asked which of 4 certificates to use. I tried the second one (that mentioned a PIV card), and I got the same subsequent errors I've had all along. So I made another new account, and this time checked the first certificate, and it worked!

So I could completely re-create all of my preferences, move my files, etc. But that's pretty involved and I run the risk of making a mistake.

How might I be able to "uninstall" or cause my smart card chain of operations to start-over so I can re-authenticate using the correct certificate? I realize now that was the problem all along, and that when originally queried over it last week, I must've chose the wrong certificate of the 4 presented to me.

Robin Sheng-MSFT 3,760 Reputation points Microsoft Vendor

2024-09-04T02:34:43.42+00:00

Hi @Warren

Glad to hear you figured out what caused the problem.

The problem turned out to be an unexpected problem with using smart cards on Mac, which involves a third party and is not within our support scope, and I am not familiar with the specific operations of Mac OS, so the solution I provided is only for reference.

Disable and restart the smart card service: Usually this will "pair" the account the next time you access this service. Commands that may be used:

Lists the tokens available in the system.

pluginkit -m -p com.apple.ctk-tokenscom.apple.CryptoTokenKit.setoken(1.0)com.apple.CryptoTokenKit.pivtoken(1.0)

Enable, deactivate, or list deactivated smart card tokens.

sudo security smartcards token [-l] [-e token] [-d token]

Unpair the smart card.

sudo sc_auth unpair -u jappleeed

Displays the available smart cards.

sudo security list-smartcards

Export the project from a smart card. sudo security export-smartcard

Smart card logs.

sudo defaults write /Library/Preferences/com.apple.security.smartcard Logging -bool true

Deactivate the built-in PIV token. sudo defaults write /Library/Preferences/com.apple.security.smartcard DisabledTokens -array com.apple.CryptoTokenKit.pivtoken

Configure certificate selection prompts: Open the "Keychain Access" application, find and select your smart card certificate, and select "Get Info". In the "Trust" tab, set "When using this certificate" to "Always ask".

https://support.apple.com/zh-cn/guide/deployment/depc705651a9/web

https://support.apple.com/zh-cn/guide/deployment/dep7b2ede1e3/web

If this does not help you solve the problem, please contact Apple Support for help. Thank you for your understanding and support.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Certificate validation error (AADSTS50017) in macOS Teams 24193.1707.3028.4282

1 answer

Your answer