Chrome brower version 85 error with ADFS 3.0 when reddirect Mail exchnage web

LK Hung 6

After Chrome update to versin 85.xxxx.83 , some client PC when user webmail exhcnage over ADFS 3.0 face with issue,
can't redirect to web mail from ADFS , if client reinstall chrome that work normal

Please Help to fix this problem.
Brs,

Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee

2020-09-16T16:59:34.48+00:00

This error is very generic. We will need more information than this.
You can look at the ADFS Admin logs from the server and find the error or warning with the Activity ID listed in this error message. It will tell you what went wrong.
Digital Underground 6 Reputation points

2020-10-11T21:10:57.92+00:00

We have the same problem. Exchange 2013 with the latest CU + ADFS 2012 R2.
Digital Underground 6 Reputation points

2020-10-12T04:34:09.597+00:00

After the last updates, Edge (Chromium) also stopped working with OWA. Everything works fine on IE, Firefox and old Edge.
Lê Khánh Hưng 1 Reputation point

2020-10-12T05:10:23.473+00:00

yes Chromium stopped working.
@Pierre Audonnet - MSFT : do you have any solution for this issue?

( ADFS log/trace only show

Event ID364

Exception details:
Microsoft.IdentityServer.Web.InvalidRequestException: MSIS7042: The same client browser session has made '6' requests in the last '13' seconds. Contact your administrator for details.
at Microsoft.IdentityServer.Web.Protocols.PassiveProtocolHandler.UpdateLoopDetectionCookie(WrappedHttpListenerContext context)
at Microsoft.IdentityServer.Web.Protocols.WSFederation.WSFederationProtocolHandler.SendSignInResponse(WSFederationContext context, MSISSignInResponse response)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.ProcessProtocolRequest(ProtocolContext protocolContext, PassiveProtocolHandler protocolHandler)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)
)
Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee

2020-10-12T16:20:34.673+00:00
I don't have an answer. I am not sure I fully understand the underlying situation as many comments tagged on with different configurations. Some of them use WAP some others don't, some other seemed to have fixed the issue by updating (or downgrading) the version of Chrome.
I can probably give you a root cause and some possible investigation paths if:

We clearly state the configuration when things were working

We clearly identify what was the trigger (an update of the browser, an update of Windows client or/and server...)

We have Fiddler trace of the issue and if we have a situation where the issue doesn't happen (or appears to be fixed) a trace of that too

Else it is just speculation. The error message we see just mean that the user has gone into a loop and that ADFS is stopping it. The root cause could be ADFS but that's impossible to say without the type of data aforementioned.
Vladimirs Kiesners 1 Reputation point

2020-10-12T17:17:07.237+00:00
Things was fine:
Exchange 2013 with CU23, OWA and ECP sites are ADFS auth
Windows Server 2019 AD DC + ADFS role (latest WU installed)

Edge browser was build xxx (not know, but may be 2-3 weeks or one month back it works fine)

today we noticed, what things became bad - OWA and ECP does not open in Edge build 86 (win 10) and Google Chrome (Samsung S20 (Android 10) smartphone.
Latest Firefox and IE works fine. All things inside corporate LAN.

Working solutions:

install Edge build 83 - problem gone until Edge autoupgrades to current build 86
or

set edge flags as chrome://flags/#reduced-referrer-granularity = "disabled" in build 86
or

Set-AdfsResponseHeaders -SetHeaderName "Referrer-Policy" -SetHeaderValue "no-referrer-when-downgrade"
=================
For me it is clear what browser is a problem, no speculation here.
Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee

2020-10-12T19:32:15.357+00:00

Good then, @Lê Khánh Hưng solving your problem too? If so I can convert the comment into an answer and you can mark it as a solution.
Digital Underground 6 Reputation points

2020-10-12T19:52:33.81+00:00

Not so fast. Set-AdfsResponseHeaders does not work in ADFS WinSrv 2012R2.
Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee

2020-10-12T19:53:53.027+00:00

But "set edge flags as chrome://flags/#reduced-referrer-granularity = "disabled" in build 86" does since it is a browser configuration.
Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee

2020-10-12T19:54:45.443+00:00

Besides, it is time to upgrade :)
Lê Khánh Hưng 1 Reputation point

2020-10-13T02:09:45.543+00:00

@Pierre Audonnet - MSFT : :( we use ADFS 2012R2 not support Set-AdfsResponseHeaders function. do you known can I modify this header setting on WAP proxy?
Lê Khánh Hưng 1 Reputation point

2020-10-13T02:16:46.917+00:00

As google says https://developers.google.com/web/updates/2020/07/referrer-policy-new-chrome-default , may be this config manual disable reduced-referrer-granularity will stop on Chrome vesion 88.
Pierre Audonnet - MSFT 10,181 Reputation points Microsoft Employee

2020-10-13T23:55:18.887+00:00

Nope. Not out of the box. If you have a hardware load balancer on the front you can inject the header eventually, but you will also break certificate based authentication with ADFS (which you don't care if you don't use it anyways).
What about the browser solution: set edge flags as chrome://flags/#reduced-referrer-granularity = "disabled"? Can't you use this?
There is always the option to upgrade to 2019, the upgrade process is fairly straight forward. Same procedure as the update to 2016: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server

13 answers

Windows Query 6 Reputation points

2020-10-01T00:14:28.86+00:00

Encountered same issue. This resolves.
https://support.microsoft.com/en-us/help/4547705/authentication-loop-between-msft-sts-microsoft-com-adfs-and-owa-in-exc

Disable chrome://flags/#reduced-referrer-granularity and also if same site setting used then disable that too.

Although the links says exchange 2016 and 2019, it works for 2013 as well.

By the way, no issues with chrome 84. Chrome 85 has it. If only these vendors coordinated and rolled it out.
Please sign in to rate this answer.

1 person found this answer helpful.
Vladimirs Kiesners 1 Reputation point

2020-10-12T12:01:46.357+00:00

thanks a lot!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Arjan Versloot 1 Reputation point

2020-09-18T08:17:03.263+00:00

same problem here with Chrome 85. when installing chrome 84 no problem.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Coombes, Chris 1 Reputation point

2020-09-23T13:49:46.99+00:00

We are seeing the same issue on all devices running Chrome 85 (Chromebook, iOS, MacOS, Windows and Android).

Version 84 works flawlessly, our users just see a Error 440 (MS Timeout) error on 85, other ADFS relaying parties seem unaffected on 85, only MS Exchange 2016 OWA.

Really hope this is sorted quickly by Google or Microsoft, easy to keep managed devices on 84 but not so easy for the 2000+ unmanaged BYO devices.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
LK Hung 6 Reputation points

2020-09-29T05:52:48.897+00:00

On ADFS log we only saw this eror Event ID364

Exception details:
Microsoft.IdentityServer.Web.InvalidRequestException: MSIS7042: The same client browser session has made '6' requests in the last '13' seconds. Contact your administrator for details.
at Microsoft.IdentityServer.Web.Protocols.PassiveProtocolHandler.UpdateLoopDetectionCookie(WrappedHttpListenerContext context)
at Microsoft.IdentityServer.Web.Protocols.WSFederation.WSFederationProtocolHandler.SendSignInResponse(WSFederationContext context, MSISSignInResponse response)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.ProcessProtocolRequest(ProtocolContext protocolContext, PassiveProtocolHandler protocolHandler)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)

And only effect on chrome, can anyone help fix this problem?
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Coombes, Chris 1 Reputation point

2020-09-29T07:27:17.553+00:00

We are seeing the same problem here in the ADFS log. Really frustrating.

The release notes for Chrome 85 are here - https://support.google.com/chrome/a/answer/7679408#85

It does mention changing the UserAgent string which may be why it's stopped working but not sure, I spent an hour trying to find a solution for it last week but have drawn a blank, it seems to effect all minor versions of Chrome 85 too.

What version of Exchange server are you running? I am thinking about patching ours to the latest release (Currently on Exchange 2016 CU10).
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Your answer