Azure Access Control Service (ACS) - ACS50001: Relying party with identifier 'https://[namespace].accesscontrol.windows.net/' was not found

Question

I have an ACS namespace with a WS-Federation identity provider set up. Since I'm using Visual Studio 2012, I used the Identity and Access Tool to create the relying party. The tool uses the realm and return url values that I give it when it creates the relying party (I use the Azure cloud service url where I'm deploying my project - i.e. http://myapp.cloudapp.net). There is only one rule in the rule group for my relying party after I run the tool - Pass through all claims for [Relying Party]. I tested the ACS for my app with just that one rule, and also after generating all the rules for the WS-Federation identity provider.

Regardless of the rules in the rule group, I get the error in the title of my question. My browser is redirected to ACS, however for some reason it can't find the correct relying party. I have created an ACS namespace, identity provider, and relying party in two different Azure accounts, with exactly the same result.

I've also tried publishing my project to the Azure cloud service with both http and https endpoints, and both endpoints yield the same result.

The WS-Federation identity provider's federation metadata is coming from Windows Azure Active Directory.

UPDATE FederationConfiguration section from web.config:

<federationConfiguration>
      <cookieHandler requireSsl="false" />
      <wsFederation passiveRedirectEnabled="true" issuer="https://[MyNamespace].accesscontrol.windows.net/v2/wsfederation" realm="http://[MyApp].cloudapp.net/" requireHttps="false" />
</federationConfiguration>

UPDATE 2: Still no solution. It looks like the issue stems from the fact that I set up my own ACS identity provider, and downloaded the federation metadata from Windows Azure Active Directory (WAAD) for that identity provider. That essentially chains 2 ACS instances together. When my app redirects to my ACS, it passes my app's url as the realm. Then, my ACS redirects to the identity provider, WAAD, and passes its own url as the realm. That's why the error I get back has the strange characteristic of a relying party identifier = the url of my own ACS admin portal. I'm not sure why it's not passing the realm all the way through from my app to WAAD.

Can you show your web.config section <federationConfiguration>? — Danila Polevshikov
it looks like you put 'https://[namespace].accesscontrol.windows.net/' in realm key inside <federationConfiguration> instead of myapp.cloudapp.net — Danila Polevshikov
Hi Danila, I put the federationConfiguration section in there. It looks like both values you mention are there ... — Andrew B Schultz
With on-premise ADFS, you can get in and see the identifiers for the relying parties, which has helped me troubleshoot in the past. But there doesn't seem to be any way to see the actual "identifier" in the ACS settings. — Andrew B Schultz
You can use the ACS management portal (namespace.accesscontrol.windows.net) to see the registered identifiers. Another thing to look at is the request itself. What is the URL of the request to ACS that generates this error? — Oren Melzer

Andrew B Schultz Andrew B Schultz · Accepted Answer · 2013-04-17T20:28:31

Well, the answer to this was much more obscure than I had expected - I had to run the following powershell script against my CRM Online WAAD:

Connect-MsolService
Import-Module MSOnlineExtended -Force
$replyUrl = New-MsolServicePrincipalAddresses –Address "https://lefederateur.accesscontrol.windows.net/"
New-MsolServicePrincipal –ServicePrincipalNames @(“https://lefederateur.accesscontrol.windows.net/”) -DisplayName “LeFederateur ACS Namespace” -Addresses $replyUrl

This told WAAD to recognize my ACS namespace, so it wouldn't throw the error saying the ACS namespace was not a valid relying party identifier. Read the whole process here:

http://www.cloudidentity.com/blog/2012/11/07/provisioning-a-directory-tenant-as-an-identity-provider-in-an-acs-namespace/

Thanks to Azure support, I'm now past the error.

Azure Access Control Service (ACS) - ACS50001: Relying party with identifier 'https://[namespace].accesscontrol.windows.net/' was not found

4 Answers