Realm not found (ACS, ADDS, AD FS)

0
votes

i am playing around with the azure free triel and followed this tutorial (http://haishibai.blogspot.de/2012/11/complete-walkthrough-setting-up-adfs-20.html) titled "Setting up a ADFS 2.0 Server on Windows Azure IaaS and Configuring it as an Identity Provider in Windows Azure ACS".

When it comes to starting the MVC Web Application i am confronted with the following in the browser:

An error occurred while processing your request. HTTP Error Code: 400 Message: ACS20000: An error occurred while processing a WS-Federation sign-in request. Inner Message: ACS50001: Relying party with realm 'https://ACS-NAMESPACE.accesscontrol.windows.net/' was not found. Trace ID: 64827ce0-71d2-49bf-996c-aadf23779fc7 Timestamp: 2012-12-13 22:17:12Z

Where ACS-NAMESPACE is the name of my ACS namespace.

I can say that i followed the steps given in the tutorial correctly, as i went through it several times. However, i can not figure our what the problem with my realm specification is.

Note: When i am configuring google or windows live as identity providers in ACS and not ADFS everything works.

Thanks, David

2
azureactive-directoryacsadfsfederated-identity
You've clearly made a mistake if you're seeing this error. The relying party realm configured at ACS should not be your ACS namespace, but instead should be the URI of the relying party website. – Oren Melzer
That's right, please see my comment to the answer below. – dave
Which website gave you the error - was it the ad server, or the azure access control site? – Ross Dargan

2 Answers

1
votes

The realm should be the URL of your MVC Web Application not the ACS URL - see http://msdn.microsoft.com/en-us/library/windowsazure/gg185906.aspx#BKMK_1 for an explanation.

1
votes

If the realm is not found on ACS it is probably incorrectly configured as a ServicePrincipal on the WAAD Management service using powershell.

Please check the following and make sure you are configuring the correct ACS Namespace (and not the WAAD Tenant Name):

See if it is listed correctly by using

Get-MsolServicePrincipal

To create another one use following cmds:

$replyUrl = New-MsolServicePrincipalAddresses -Address "https://ACSNAMESPACE.accesscontrol.windows.net/" New-MsolServicePrincipal -ServicePrincipalNames @("https://ACSNAMESPACE.accesscontrol.windows .net/") -DisplayName "ACSNAMESPACE Namespace" -Addresses $replyUrl