ADFS problem - Automatic Logon is not working

Question

I have a problem when logging onto an application using ADFS via a web browser (IE or Chrome). I want to login automatically and transparently a user (current user logged) with ADFS SAML without entering these identifiers.

So I have 2 servers running Windows 2016 Server: - the first Serv1: domain controller with Active Directory directory - the second Serv2: ADFS server (4.0) and it is join to the controller Serv1

when I tried to access to my application, I encounter the following error :

An error occurred. Contact your administrator for more information

Activity ID: 00000000-0000-0000-d000-0080000000fa Relying party: preprod.xxxxxxxxx.com - DMS Error time: Mon, 10 Jun 2019 13:27:07 GMT Cookie: enabled User agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36

We can see the below in the ADFS event log on ADFS server:

Encountered error during federation passive request.

Additional Data

Protocol Name: Saml

Relying Party: https://preprod.xxxxxxxxx.com:443/auth/saml/metadata/alias/dms

Exception details: Microsoft.IdentityServer.AuthenticationFailedException: MSIS3111: Non domain user is not supported by AD FS. ---> System.IdentityModel.Tokens.SecurityTokenValidationException: MSIS3111: Non domain user is not supported by AD FS. at Microsoft.IdentityServer.Service.LocalAccountStores.ActiveDirectory.ActiveDirectoryCpTrustStore.ProcessPrincipal(IClaimsPrincipal incomingPrincipal) at Microsoft.IdentityServer.Service.SecurityTokenService.MSISSecurityTokenService.BeginGetScope(IClaimsPrincipal principal, RequestSecurityToken request, AsyncCallback callback, Object state) at Microsoft.IdentityModel.SecurityTokenService.SecurityTokenService.BeginIssue(IClaimsPrincipal principal, RequestSecurityToken request, AsyncCallback callback, Object state) at Microsoft.IdentityServer.Web.WSTrust.SecurityTokenServiceManager.Issue(RequestSecurityToken request, IList1& identityClaimSet, List1 additionalClaims) at Microsoft.IdentityServer.Web.Protocols.PassiveProtocolHandler.SubmitRequest(MSISRequestSecurityToken request, IList1& identityClaimCollection) --- End of inner exception stack trace --- at Microsoft.IdentityServer.Web.Protocols.PassiveProtocolHandler.SubmitRequest(MSISRequestSecurityToken request, IList1& identityClaimCollection) at Microsoft.IdentityServer.Web.Protocols.PassiveProtocolHandler.RequestBearerToken(MSISRequestSecurityToken signInRequest, Uri& replyTo, IList`1& identityClaimCollection) at Microsoft.IdentityServer.Web.Protocols.PassiveProtocolHandler.RequestSingleSignOnToken(ProtocolContext context, SecurityToken securityToken, SecurityToken deviceSecurityToken) at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.BuildSsoSecurityToken(SamlSignInContext context, SecurityToken securityToken, SecurityToken deviceSecurityToken, SecurityToken& ssoSecurityToken) at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.BuildSignInResponseCoreWithSecurityToken(SamlSignInContext context, SecurityToken securityToken, SecurityToken deviceSecurityToken) at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.Process(ProtocolContext context) at Microsoft.IdentityServer.Web.PassiveProtocolListener.ProcessProtocolRequest(ProtocolContext protocolContext, PassiveProtocolHandler protocolHandler) at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)

System.IdentityModel.Tokens.SecurityTokenValidationException: MSIS3111: Non domain user is not supported by AD FS. at Microsoft.IdentityServer.Service.LocalAccountStores.ActiveDirectory.ActiveDirectoryCpTrustStore.ProcessPrincipal(IClaimsPrincipal incomingPrincipal) at Microsoft.IdentityServer.Service.SecurityTokenService.MSISSecurityTokenService.BeginGetScope(IClaimsPrincipal principal, RequestSecurityToken request, AsyncCallback callback, Object state) at Microsoft.IdentityModel.SecurityTokenService.SecurityTokenService.BeginIssue(IClaimsPrincipal principal, RequestSecurityToken request, AsyncCallback callback, Object state) at Microsoft.IdentityServer.Web.WSTrust.SecurityTokenServiceManager.Issue(RequestSecurityToken request, IList1& identityClaimSet, List1 additionalClaims) at Microsoft.IdentityServer.Web.Protocols.PassiveProtocolHandler.SubmitRequest(MSISRequestSecurityToken request, IList`1& identityClaimCollection)

In the other machine, i have this error :

https://srv-adfs.ppppppppp.local/adfs/ls/wia?SAMLRequest=jZJBb4JAEIXv%2FRVk77CAaHQjGFtjamJTIthDb8OyIhV26c5i%2BvOLotFeTJO57GTmm5f3djr7qSvrKDSWSobEc1xiCclVXsoiJNt0aY%2FJLHqaItSV37B5a%2FZyI75bgcaaIwptur0XJbGthU6EPpZcbDfrkOyNaZBR2mjRaJU7SuW6PAqHq5oFwYBCR6InKk2SdwpVCUjzGom16NClBHPWc6WgPtrZobEh36GTAT%2B0TaFV2zjIeU1PXVohJdZSaS7OIkOygwoFsVaLkMA%2By3aDcTH0vvKxnweBPxZ8UnDu8WGWdTMYA2In77aF2IqVRAPShMR3vYntjmzPTb2AdeX7zmjgfRIr1soorqrnUvaWtVoyBVgik1ALZIazZP62Zr7jsqwfQvaaprEdvycpsT6u1vsn67swJLLe7Mes5nKYRH027KxY3xMeA%2BCaHon%2Bn1UtDORg4BbYlN6fjy7Pvz8l%2BgU%3D&RelayState=%7C%7Cbackup-webclient&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=SxWuSQC3I77BXcfCxR%2Bicp1ES%2FgrQDZdx8W8XPxC51JRmNeVxfXI%2BDWgCV8bMrTl%2BYc8I6VZPJxDVPPzTQEZihQaXl0ib2Q268OiNwU1bN9pDL6EpuMM9nCxuEQEdtW58M%2F%2Bjs07j1Rp40VD8AVbvQrpv67AgXXdLWGrSSvZHPwrHLy8fhpSDmg57F8g1zD5%2BMpijrx%2F4n5e8MIK6fBUDPWfAaWCjXgHoo%2B7PFr%2Fp8w5MMa9ZPLDg7yQrMGSQ3on1UxpM091Uu85S%2ByI0aYDHmgZk%2BmGwBUblDWleenUwyAMjopZ3TJx4%2Feng2uBD8%2FbLfWUmbitMMMdsLbIOEb%2Bng%3D%3D&client-request-id=00000000-0000-0000-1201-0080000000dc

HTTP 400 BadRequest The webpage cannot be found

Do you have an idea about this problem? Thanks

Oilid Oilid · Accepted Answer · 2019-07-08T09:41:18

I solved the problem by setting an SPN (Service Principal Name) to the ADFS service account HTTP/FQDN

ADFS problem - Automatic Logon is not working

1 Answers