0

I have a Sitecore 9.1.1 instance that I am trying to configure to use ADFS 2016 for Federated Authentication. I am following the instructions from this blog post - https://blog.istern.dk/2019/05/15/sitecore-9-1-identityserver-on-premise-ad-via-adfs/. When I click on the new Login With ADFS button I get a Chrome error screen that says the Identity Server is "currently unable to handle this request" HTTP 500 error. When I look in the Identity Server logs I see the following, but I have absolutely no idea what it means or how to troubleshoot it.

2019-06-07T13:08:54.3688010-04:00 [INF] (Sitecore STS/VSLT-D3CV4H2) Executing action method "Sitecore.Plugin.IdentityServer.Controllers.AccountController.ExternalLogin (Sitecore.Plugin.IdentityServer)" with arguments (["adfs", "/connect/authorize/callback?client_id=Sitecore&response_mode=form_post&response_type=code%20id_token%20token&scope=openid%20sitecore.profile&state=OpenIdConnect.AuthenticationProperties%3D71mbGM-gg9b4GNwAXgLZ48zBeDsbQ-MphZ8cP0Rq1ni3YoaIwA7W-QBcOvjQyr91SX0VmMFVEHC9ecu8WVCJfvOooVTqkW1apNIHN3aBaCEp0SEuAtB5djhpNOOU4_ggkY5qqJA4ibSstUWwMUAEh9iNNGhxkDTdKj0olNk4wmHXgQE00R_SAO0lMvvpmrFy-ebwJ2DN5khoI9JbSXT76Q&nonce=636955241322185780.MTZlYzhiMjYtOGM3Mi00NDI1LTg4NjUtNmMyNWMyMWExYjJmMTE3OTQyNjAtYTU5Ni00YzdkLTg4ZjktNmNjOTQ4YjcyMmYw&redirect_uri=http%3A%2F%2Fkellogg91.local%2Fidentity%2Fsignin&sc_account_prefix=sitecore%5C&x-client-SKU=ID_NET451&x-client-ver=5.2.2.0"]) - Validation state: Valid

2019-06-07T13:08:54.3689117-04:00 [INF] (Sitecore STS/VSLT-D3CV4H2) Executed action method "Sitecore.Plugin.IdentityServer.Controllers.AccountController.ExternalLogin (Sitecore.Plugin.IdentityServer)", returned result "Microsoft.AspNetCore.Mvc.ChallengeResult" in 0.0458ms.

2019-06-07T13:08:54.3689844-04:00 [INF] (Sitecore STS/VSLT-D3CV4H2) Executing ChallengeResult with authentication schemes (["adfs"]).

2019-06-07T13:08:54.7336916-04:00 [INF] (Sitecore STS/VSLT-D3CV4H2) Executed action "Sitecore.Plugin.IdentityServer.Controllers.AccountController.ExternalLogin (Sitecore.Plugin.IdentityServer)" in 365.7107ms

2019-06-07T13:08:54.7341497-04:00 [ERR] (Sitecore STS/VSLT-D3CV4H2) Connection id ""0HLNBD6RJUVVQ"", Request id ""0HLNBD6RJUVVQ:00000004"": An unhandled exception was thrown by the application. System.InvalidOperationException: IDX20803: Unable to obtain configuration from: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'. ---> Newtonsoft.Json.JsonReaderException: Unexpected character encountered while parsing value: <. Path '', line 1, position 1. at Newtonsoft.Json.JsonTextReader.ParseValue() at Newtonsoft.Json.JsonReader.ReadForType(JsonContract contract, Boolean hasConverter) at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.Deserialize(JsonReader reader, Type objectType, Boolean checkAdditionalContent) at Newtonsoft.Json.JsonSerializer.DeserializeInternal(JsonReader reader, Type objectType) at Newtonsoft.Json.JsonConvert.DeserializeObject(String value, Type type, JsonSerializerSettings settings) at Newtonsoft.Json.JsonConvert.DeserializeObject[T](String value, JsonSerializerSettings settings) at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel) at Microsoft.IdentityModel.Protocols.ConfigurationManager1.GetConfigurationAsync(CancellationToken cancel) --- End of inner exception stack trace --- at Microsoft.IdentityModel.Protocols.ConfigurationManager1.GetConfigurationAsync(CancellationToken cancel) at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleChallengeAsync(AuthenticationProperties properties) at Microsoft.AspNetCore.Authentication.AuthenticationHandler1.ChallengeAsync(AuthenticationProperties properties) at Microsoft.AspNetCore.Authentication.AuthenticationService.ChallengeAsync(HttpContext context, String scheme, AuthenticationProperties properties) at Microsoft.AspNetCore.Mvc.ChallengeResult.ExecuteResultAsync(ActionContext context) at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeResultAsync(IActionResult result) at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeNextResultFilterAsyncTFilter,TFilterAsync at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Rethrow(ResultExecutedContext context) at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.ResultNext[TFilter,TFilterAsync](State& next, Scope& scope, Object& state, Boolean& isCompleted) at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeResultFilters() at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeNextResourceFilter() at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Rethrow(ResourceExecutedContext context) at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeFilterPipelineAsync() at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeAsync()
at Microsoft.AspNetCore.Builder.RouterMiddleware.Invoke(HttpContext httpContext) at Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.Invoke(HttpContext context) at Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Invoke(HttpContext context) at IdentityServer4.Hosting.IdentityServerMiddleware.Invoke(HttpContext context, IEndpointRouter router, IUserSession session, IEventService events) at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context) at Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.Invoke(HttpContext context) at IdentityServer4.Hosting.BaseUrlMiddleware.Invoke(HttpContext context) at Microsoft.AspNetCore.Server.IISIntegration.IISMiddleware.Invoke(HttpContext httpContext) at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication1 application)

2019-06-07T13:08:54.7366113-04:00 [DBG] (Sitecore STS/VSLT-D3CV4H2) Connection id ""0HLNBD6RJUVVQ"" completed keep alive response.

2019-06-07T13:08:54.7366776-04:00 [INF] (Sitecore STS/VSLT-D3CV4H2) Request finished in 369.7736ms 500

EDIT: here is the XML configuration file for this instance. It is located at [Identity Server Root]/sitecoreruntime/production/sitecore/[ClientName].ADFS/Config/[ClientName].ADFS.xml

<?xml version="1.0" encoding="utf-8" ?>

<Settings>
  <Sitecore>
    <ExternalIdentityProviders>
  <IdentityProviders>
  <ADFS type="Sitecore.Plugin.IdentityProviders.IdentityProvider, Sitecore.Plugin.IdentityProviders">
    <AuthenticationScheme>adfs</AuthenticationScheme>
    <DisplayName>Login with My Custom ADFS</DisplayName>
    <Enabled>true</Enabled>
    <ClientId>1234</ClientId>
    <Authority>[full URL for ADFS endpoint goes here]</Authority>
    <MetaAddress>[full URL for ADFS metadata goes here]</MetaAddress>
    <ClaimsTransformation>
      <ClaimsTransformation1 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
        <SourceClaims>
          <Claim1 type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" />
        </SourceClaims>
        <NewClaims>
          <Claim1 type="name" />
        </NewClaims>
      </ClaimsTransformation1>
      <ClaimsTransformation2 type="Sitecore.Plugin.IdentityProviders.DefaultClaimsTransformation, Sitecore.Plugin.IdentityProviders">
        <SourceClaims>
          <Claim1 type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" />
        </SourceClaims>
        <NewClaims>
          <Claim1 type="email" />
        </NewClaims>
      </ClaimsTransformation2>
    </ClaimsTransformation>
  </ADFS>
  </IdentityProviders>
</ExternalIdentityProviders>
  </Sitecore>
</Settings>
  • Can you post the configuration?? It seems like some invalids configuration – Thomas Stern Jun 8 at 10:49
  • You can try to set IdentityModelEventSource.ShowPII = true; in ConfigureServices to enable viewing of PII logs to see more details error message. – x3mxray Jun 9 at 11:57
  • Thomas Stern - which configuration should I post here? /Config/production/Sitecore.IdentityServer.Host.xml? /sitecoreruntime/production/sitecore/myProvider/Config? Some other config file on the Identity Server? – Corey Burnett Jun 10 at 18:06
  • x3mxray - where can I set that to true? Is that in a config file somewhere? – Corey Burnett Jun 10 at 18:06
  • The configuration for the on-prem adfs module – Thomas Stern Jun 10 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.