Hello everyone!
We are deploying a Sharepoint-hosted web-app on a Sharepoint 2013-server (on-premise), using ACS as Federation Provider, and ADFS v2.0 as Identity Provider towards ACS. ADFS is connected to our organizations AD.
Our goal is to enable Single Sign-on for the entire organization, both internally and externally.
In ACS, our Sharepoint-app is listed as a "Relying Party". It is configured properly, at least on paper. ADFS is listed as an "Identity Provider" in ACS. We have created a certificate on our respective ADFS-server, and connected this to our ACS. The same goes the other way; our ACS-metadata has been used to create a certificate for ACS to reside within ADFS.
We have also established a default "Rule Group" for ADFS in ACS, acquiring every claim there is. Our web-app is however programmed to only accept certain user groups, for authorization.
On our Sharepoint-server, we have created both a "Trusted Root Authority" and "Trusted Identity Token Issuer" based on that authority-s certificate, using Sharepoint Shell Manager.
Also, we have configured our web app to use the given IDP from Central Administration > Administrate Web Applications > Authentication Provider > Claims-based IDP.
Now, whenever we attempt to access the application from within the domain, we are sent to ACS, directing us to the ADFS login page. Granted the credentials are correct, we are sent ahead into an infinite loop. It keeps toggling between our ACS and ADFS-endpoints. After about 5 seconds, it terminates the attempt and returns an error.
If we try to access the application externally, we aren't even prompted to enter our credentials. We are not even sent to the login page. Instead, the following (scarce) error appears:
404 NOT FOUND
We have tried to use Fiddler to trace the route. Upon entering the URL for our application, three lines are revealed: Our applicaton > ACS > ADFS.
It then stops.We have also attempted to troubleshoot the problem using the Event Viewer on our ADFS-server, to no good.
The following guide has been utilized to establish most of it:
http://blogs.technet.com/b/speschka/archive/2011/05/05/federated-saml-authentication-with-sharepoint-2010-and-azure-access-control-service-part-1.aspx
A couple of different PluralSight tutorials have also been used. Besides these sources, assorted websites have been visited in an attempt to solve the problem.
Any experience with equal systems out there? Also, what could possibly cause this infinite loop between our IDP and FP? Ideally, the token issued by ADFS would be signed and sent to ACS, signing it with its own signature before finally sending it to the application, granting access to the user.
Any help would be most appreciated! Also, more complete error messages or trace logs will of course be submitted if necessary.









