1,303 questions
Also, this is my ADFS certificates details, communication cert, token-signing cert etc.132092-cert.txt
Any ideas?
ADFS claims based authentication integrated with Exchange 2013 CU23
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(64, 96%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EH%3C/text%3E%3C/svg%3E)
HybriAdmin
1
Reputation point
Hello, I have ADFS+Exchange 2013 CU23 + one DC and a single domain. I followed https://learn.microsoft.com/en-us/exchange/using-ad-fs-claims-based-authentication-with-outlook-web-app-and-eac-exchange-2013-help
deployed ADFS auth with Ex2013, however, I cannot sign in ECP or OWA, it goes to ADFS page with an error "An error occurred. Contact your administrator for more information"
I've checked seems the settings are configured as expected
131910-get-org.txt
I don't have WAP server, currently in the intranet. May I know why this issue happens, and what I should do to resolve it?
Microsoft Security Active Directory Federation Services
Exchange Exchange Server Management
7,920 questions
{count} votes
-
Pierre Audonnet - MSFT 10,191 Reputation points Microsoft Employee2021-09-14T19:29:00.717+00:00 Can you paste the details of the event you should see in the AD DS Admin logs with the Activity ID you see in the screenshot.
-
HybriAdmin 1 Reputation point
2021-09-15T02:20:31.077+00:00 Hello, Support.
I didn't get the error log from ADDS server, however, I got the error log from ADFS server as below
Encountered error during federation passive request.
Additional Data
Protocol Name:
wsfedRelying Party:
https://mail.0365.website/ecp/Exception details:
Microsoft.IdentityServer.Web.InvalidScopeException: MSIS7007: The requested relying party trust 'https://mail.0365.website/ecp/' is unspecified or unsupported. If a relying party trust was specified, it is possible that you do not have permission to access the trust relying party. Contact your administrator for details.
at Microsoft.IdentityServer.Web.Protocols.WSFederation.WSFederationSignInContext.Validate()
at Microsoft.IdentityServer.Web.Protocols.WSFederation.WSFederationProtocolHandler.GetRequiredPipelineBehaviors(ProtocolContext pContext)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)May I know why it shows I seems don't have access permission to the relay trust, I set up with AD domain admin contoso\administrator, what should I do?
Thanks in advance.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 22%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKY%3C/text%3E%3C/svg%3E)
Kael Yao 37,746 Reputation points Moderator2021-09-15T06:24:29.13+00:00 Hi @HybriAdmin
According to the error message "MSIS7007: The requested relying party trust 'https://mail.0365.website/ecp/' is unspecified or unsupported. If a relying party trust was specified, it is possible that you do not have permission to access the trust relying party. "
is this url "https://mail.0365.website/ecp/" included in the Relaying party identifiers?
-
HybriAdmin 1 Reputation point
2021-09-15T07:21:57.19+00:00 Thanks KaelYao,
Yes, I've already checked the identifiers, they are listed there, any other ideas why this issue happens? I didn't have any firewall ( all turned off ) and followed the official article to set up, the certificate is active.
Thanks,
Hybrid -
HybriAdmin 1 Reputation point
2021-09-15T07:25:47.097+00:00 But only difference I noticed is, from your screenshot, you added both ecp and owa identifier url into the same OWA trust relationship, in my lab, I only have owa added to OWA, ecp url added into ECP trust....
-
Kael Yao 37,746 Reputation points Moderator
2021-09-15T07:38:48.85+00:00 Hi,
Yes. Your settings should be correct.
For ECP you may need to create a new relying party trust.
Sorry for the confusion caused.While I suppose the OWA url doesn't work either? Does it show the same error?
-
HybriAdmin 1 Reputation point
2021-09-15T07:44:44.227+00:00 Yes, OWA doesn't work either, same error message, I already created owa and ecp trust separately, but the issue happens after i enabled ADFS auth for both ECP and OWA
-
HybriAdmin 1 Reputation point
2021-09-16T07:35:02.967+00:00 Hello KaelYao,
Do you have any other ideas?
Thanks
-
Kael Yao 37,746 Reputation points Moderator
2021-09-16T08:26:40.137+00:00 Hi,
Sorry I have been testing in my lab but cannot reproduce this issue.What is the windows server version of your ADFS server?
If it is installed on windows server 2016, I suppose the possible cause may be some compatibility issues.
Here is a thread discussing it for your reference: Exchange 2013 OWA SSO using ADFS 3.0 -
HybriAdmin 1 Reputation point
2021-09-16T11:26:56.94+00:00 I installed Exchange 2013, DC, ADFS on windows server 2012 datacenter version, and it doesn't work if I login the OWA/ECP.
Also I have another lab environment, also deployed ADFS with Exchange 2016, it works with IE, old Edge, but not new edge/chrome, if I sign in via new edge or chrome, it can open ADFS login page, however, if I entered the domain\user and password, it shows error
An error occurred
An error occurred. Contact your administrator for more information.
Error details
Activity ID: bf533a3c-41d0-4fed-2a00-0080010000d1
Relying party: ECP
Error details: MSIS7042: The same client browser session has made '6' requests in the last '1' seconds. Contact your administrator for details.
Node name: 01ded9ab-e507-412e-b199-c29a6d02254a
Error time: Thu, 16 Sep 2021 11:25:30 GMT
Cookie: enabled
User agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36But it works as expected via IE or old edge browser, any ideas?
-
Kael Yao 37,746 Reputation points Moderator
2021-09-17T05:35:23.98+00:00 Hi,
Do you have redirection settings in OWA and ECP virtual directories in IIS?
If not, I suppose the cause may be on ADFS side.And I also notice that you have created a new thread for this issue: ADFS error after integrated with Exchange server
We may focus on that thread and see if other community members may share their insights on this issue. -
HybriAdmin 1 Reputation point
2021-09-20T07:43:55.013+00:00 Hello KaelYao,
Yes, I created the new thread for another issue on Exchange 2016 ADFS, however this thread is mainly for Exchange 2013 Cu23 for ADFS login issue, they are different environments, and I still want to know why I set up the ADFS integration with Exchange 2013, but cannot sign in OWA or ECP, I enabled OWA and ECP for ADFS authentication, not sure if this is the IIS redirection you mentioned above, but I always got the error above, please help, thanks.
Sign in to comment