{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3.WsFederation/issues/85","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.WsFederation","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.WsFederation/issues/85/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.WsFederation/issues/85/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.WsFederation/issues/85/events","html_url":"https://github.com/IdentityServer/IdentityServer3.WsFederation/issues/85","id":188900976,"number":85,"title":"WS-Federation signin response exception (SharePoint 2013)","user":{"login":"vizvtwow","id":23414598,"avatar_url":"https://avatars.githubusercontent.com/u/23414598?v=3","gravatar_id":"","url":"https://api.github.com/users/vizvtwow","html_url":"https://github.com/vizvtwow","followers_url":"https://api.github.com/users/vizvtwow/followers","following_url":"https://api.github.com/users/vizvtwow/following{/other_user}","gists_url":"https://api.github.com/users/vizvtwow/gists{/gist_id}","starred_url":"https://api.github.com/users/vizvtwow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vizvtwow/subscriptions","organizations_url":"https://api.github.com/users/vizvtwow/orgs","repos_url":"https://api.github.com/users/vizvtwow/repos","events_url":"https://api.github.com/users/vizvtwow/events{/privacy}","received_events_url":"https://api.github.com/users/vizvtwow/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-12T08:47:23Z","updated_at":"2016-12-05T10:18:23Z","closed_at":null,"body":"Hello,\r\n\r\ni've configured the IdentityServer3 ([2.5.4](https://github.com/IdentityServer/IdentityServer3/releases/tag/2.5.4)) with IdentityServer3.WsFederation plugin ([2.6.0](https://github.com/IdentityServer/IdentityServer3.WsFederation/releases/tag/2.6.0)) as trusted identity provider for SharePoint 2013. Both applications using SSL are running on different machines (Windows Server 2012) within test environment. The following exception occured in the function [CreateSecurityToken](https://github.com/IdentityServer/IdentityServer3.WsFederation/blob/master/source/WsFederationPlugin/ResponseHandling/SignInResponseGenerator.cs#L195) in class [SignInResponseGenerator](https://github.com/IdentityServer/IdentityServer3.WsFederation/blob/master/source/WsFederationPlugin/ResponseHandling/SignInResponseGenerator.cs). The authentication process at ADFS is working without any problems.\r\n\r\nFirst i've supposed some permission issues with the signing certificate and private key access on Windows Server 2012. But it doesn't seems so. The identity of the default application pool of the identity server within the IIS has been set to 'Network Service'. The details of the exception message in combination with the global member are not very helpful.\r\n\r\n**Exception**\r\n```\r\nSystem.Security.Cryptography.CryptographicException: m_safeCertContext is an invalid handle.\r\n```\r\n\r\nI've attached the important configuration parts and log file.\r\n\r\n**Log**\r\n```\r\nw3wp.exe Information: 0 : 2016-11-11 12:55:49.326 +01:00 [Information] rendering login page\r\nw3wp.exe Information: 0 : 2016-11-11 12:55:51.411 +01:00 [Information] External login requested for provider: \"adfs\"\r\nw3wp.exe Information: 0 : 2016-11-11 12:55:51.412 +01:00 [Information] Triggering challenge for external identity provider\r\nw3wp.exe Information: 0 : 2016-11-11 12:55:51.689 +01:00 [Information] Clearing tokens\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:01.750 +01:00 [Information] Clearing tokens\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:10.400 +01:00 [Information] CORS request made for path: \"/\" from origin: \"https://adfs.***.local\" but rejected because invalid CORS path\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:10.447 +01:00 [Information] Callback invoked from external identity provider\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:10.449 +01:00 [Information] external user provider: \"adfs\", provider ID: \"***@***.local\"\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:10.449 +01:00 [Information] External identity successfully validated by user service\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:10.449 +01:00 [Information] Calling PostAuthenticateAsync on the user service\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:10.449 +01:00 [Information] issuing primary signin cookie\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:10.449 +01:00 [Information] redirecting to: https://test_auth.***.local/IdentityServer/wsfed?wa=wsignin1.0&wtrealm=urn:identityServer&wctx=https:%2f%2ftest_sps.***.local%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:10.492 +01:00 [Information] Start WS-Federation request\r\n2016-11-11 12:56:10.492 +01:00 [Debug] AbsoluteUri: [\"https://test_auth.***.local/IdentityServer/wsfed?wa=wsignin1.0&wtrealm=urn%3aidentityServer&wctx=https%3a%2f%2ftest_sps.***.local%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F\"]\r\n2016-11-11 12:56:10.492 +01:00 [Debug] PublicUri: [https://test_auth.***.local/IdentityServer/wsfed?wa=wsignin1.0&wtrealm=urn:identityServer&wctx=https:%2f%2ftest_sps.***.local%2f_layouts%2f15%2fAuthenticate.aspx%3fSource%3d%252F]\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:10.492 +01:00 [Information] WsFederation signin request\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:10.493 +01:00 [Information] Start WS-Federation signin request validation\r\n2016-11-11 12:56:10.561 +01:00 [Debug] Calling into custom validator: IdentityServer3.WsFederation.Services.DefaultCustomWsFederationRequestValidator\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:10.561 +01:00 [Information] End WS-Federation signin request validation\r\n\"{\r\n  \\\"Realm\\\": \\\"urn:identityServer\\\",\r\n  \\\"ReplyUrl\\\": \\\"https://test_auth.***.local/IdentityServer\\\"\r\n}\"\r\nw3wp.exe Information: 0 : 2016-11-11 12:56:10.561 +01:00 [Information] Creating WS-Federation signin response\r\nw3wp.exe Error: 0 : 2016-11-11 12:56:10.598 +01:00 [Error] Unhandled exception\r\nSystem.Security.Cryptography.CryptographicException: m_safeCertContext is an invalid handle.\r\n   at System.Security.Cryptography.X509Certificates.X509Certificate.get_Issuer()\r\n   at System.IdentityModel.Tokens.X509SecurityToken.CreateKeyIdentifierClause[T]()\r\n   at System.IdentityModel.Tokens.X509EncryptingCredentials..ctor(X509SecurityToken token)\r\n   at System.IdentityModel.Tokens.EncryptedKeyEncryptingCredentials..ctor(X509Certificate2 certificate)\r\n   at IdentityServer3.WsFederation.ResponseHandling.SignInResponseGenerator.CreateSecurityToken(SignInValidationResult validationResult, ClaimsIdentity outgoingSubject)\r\n   at IdentityServer3.WsFederation.ResponseHandling.SignInResponseGenerator.<GenerateResponseAsync>d__1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()\r\n   at IdentityServer3.WsFederation.WsFederationController.<ProcessSignInAsync>d__10.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)\r\n   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n```\r\n\r\n**WsFederationAuthenticationOptions**\r\n```c#\r\nvar adfs = new WsFederationAuthenticationOptions\r\n{\r\n    AuthenticationType = \"adfs\",\r\n    Caption = \"ADFS\",\r\n    SignInAsAuthenticationType = signInAsType,\r\n    MetadataAddress = \"https://TEST_AUTH.***.local/FederationMetadata/2007-06/FederationMetadata.xml\",\r\n    Wtrealm = \"urn:identityServer\"\r\n};\r\n\r\napp.UseWsFederationAuthentication(adfs);\r\n```\r\n\r\n**RelyingParty**\r\n```c#\r\npublic static IEnumerable<RelyingParty> Get()\r\n{\r\n    return new List<RelyingParty>\r\n    {\r\n        new RelyingParty\r\n        {\r\n            Realm = \"urn:identityServer\",\r\n            Enabled = true,\r\n            TokenType = TokenTypes.Saml11TokenProfile11,\r\n            TokenLifeTime = 1000,\r\n            DefaultClaimTypeMappingPrefix = \"https://schema.org/\",\r\n            ReplyUrl = \"https://test_sps/\", //_trust/\",\r\n            SignatureAlgorithm = SecurityAlgorithms.RsaSha1Signature,\r\n            DigestAlgorithm = SecurityAlgorithms.Sha1Digest,\r\n            ClaimMappings = new Dictionary<string, string>\r\n            {\r\n                { \"sub\", ClaimTypes.NameIdentifier },\r\n                { \"name\", ClaimTypes.Name },\r\n                { \"given_name\", ClaimTypes.GivenName },\r\n                { \"family_name\", ClaimTypes.Surname },\r\n                { \"email\", ClaimTypes.Email },\r\n                { \"upn\", ClaimTypes.Upn }\r\n            }\r\n        }\r\n    };\r\n}\r\n```\r\n\r\n**PowerShell script to append trusted provider**\r\n```PowerShell\r\n## DEFINE FUNCTIONS\r\nfunction findObjectItem($object, $name, $value) {\r\n    for ($i=0; $i -lt $object.length; $i++) {\r\n        $item = $object[$i]\r\n        if ($item.$name -eq $value) {\r\n            return $item\r\n        }\r\n    }\r\n}\r\n\r\n## PROPERTIES\r\n$realm = \"urn:identityServer\"\r\n$signinurl = \"https://test_auth.***.local/IdentityServer/wsfed\"\r\n$description = \"This ist  Provide description here\"\r\n$url = \"http://test_sps/\"\r\n$metadataurl = \"https://test_auth.***.local/IdentityServer/wsfed/metadata\"\r\n\r\n## LOAD FEDERATION METADATA\r\n$fedmd = Invoke-WebRequest -Uri $metadataurl\r\n$fedmdXml = New-Object Xml\r\n$fedmdXml.LoadXml($fedmd.Content)\r\n$base64 = $fedmdXml.EntityDescriptor.RoleDescriptor.KeyDescriptor.KeyInfo.X509Data.X509Certificate\r\n$base64| Out-File -FilePath temp.cer -Append:$false\r\n$cert = Get-PfxCertificate -FilePath temp.cer\r\nRemove-Item temp.cer\r\n\r\n## ADD TRUST IN SP\r\nasnp *sh*\r\n$name = $fedmdXml.EntityDescriptor.RoleDescriptor.GetAttribute(\"ServiceDescription\")[0]\r\n$auth = findObjectItem -object $(Get-SPTrustedRootAuthority) -name \"Name\" -value $name\r\nif ($auth) {\r\n   Remove-SPTrustedRootAuthority -Identity $auth\r\n}\r\nNew-SPTrustedRootAuthority -Name $name -Certificate $cert | Out-Null\r\n\r\n## CREATE TRUSTED IDENTITY TOKEN ISSUER\r\n$map1 = New-SPClaimTypeMapping \"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\" `\r\n    -IncomingClaimTypeDisplayName \"Email\" -SameAsIncoming \r\n$map2 = New-SPClaimTypeMapping \"http://schemas.microsoft.com/ws/2008/06/identity/claims/role\" `\r\n    -IncomingClaimTypeDisplayName \"Role\" -SameAsIncoming\r\n$map3 = New-SPClaimTypeMapping \"http://schemas.microsoft.com/ws/2008/06/identity/claims/givenname\" `\r\n    -IncomingClaimTypeDisplayName \"GivenName\" -SameAsIncoming\r\n$map4 = New-SPClaimTypeMapping \"http://schemas.microsoft.com/ws/2008/06/identity/claims/surname\" `\r\n    -IncomingClaimTypeDisplayName \"Surname\" -SameAsIncoming\r\n$issuer = findObjectItem -object $(Get-SPTrustedIdentityTokenIssuer) -name \"Name\" -value $name\r\nif ($issuer) {\r\n    Remove-SPTrustedIdentityTokenIssuer -Identity $issuer\r\n}\r\n$issuer = New-SPTrustedIdentityTokenIssuer -Name $name -Description $description -Realm $realm `\r\n    -ImportTrustCertificate $cert -ClaimsMappings $map1,$map2,$map3,$map4 -SignInUrl $signinurl `\r\n    -IdentifierClaim $map1.InputClaimType\r\n```\r\n\r\n**SharePoint External Authentication Provider enabled**\r\n\r\n![05_sharepoint_external_authentication_provider](https://cloud.githubusercontent.com/assets/23414598/20236666/ebb4d984-a8bb-11e6-9d3a-e13fca69f92d.JPG)\r\n\r\n**Properties of the Certificate for token signing**\r\n\r\n![06_token_signing_certificate_properties](https://cloud.githubusercontent.com/assets/23414598/20236667/ebd259f0-a8bb-11e6-8f13-e6697239128a.JPG)\r\n\r\nMaybe there is someone with experience of adding IdentityServer3 as trusted provider to SharePoint 2013. A new sample in the repository would also be helpful. Most entries on GitHub and Stackoverflow are deprecated or affect IdentityServer2.\r\n\r\nAn example for the creation of the signing certificate with New-SelfSignedCertificate (PowerShell) would also be nice. The only example i found was made for MakeCert. Microsoft [says](https://msdn.microsoft.com/de-de/library/windows/desktop/aa386968(v=vs.85).aspx): \"MakeCert is deprecated. To create self-signed certificates, use the Powershell Cmdlet New-SelfSignedCertificate\".\r\n\r\nThanks for the help in advance.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3.WsFederation/issues/comments/264816456","html_url":"https://github.com/IdentityServer/IdentityServer3.WsFederation/issues/85#issuecomment-264816456","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3.WsFederation/issues/85","id":264816456,"user":{"login":"scottbrady91","id":5598125,"avatar_url":"https://avatars.githubusercontent.com/u/5598125?v=3","gravatar_id":"","url":"https://api.github.com/users/scottbrady91","html_url":"https://github.com/scottbrady91","followers_url":"https://api.github.com/users/scottbrady91/followers","following_url":"https://api.github.com/users/scottbrady91/following{/other_user}","gists_url":"https://api.github.com/users/scottbrady91/gists{/gist_id}","starred_url":"https://api.github.com/users/scottbrady91/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scottbrady91/subscriptions","organizations_url":"https://api.github.com/users/scottbrady91/orgs","repos_url":"https://api.github.com/users/scottbrady91/repos","events_url":"https://api.github.com/users/scottbrady91/events{/privacy}","received_events_url":"https://api.github.com/users/scottbrady91/received_events","type":"User","site_admin":false},"created_at":"2016-12-05T10:18:23Z","updated_at":"2016-12-05T10:18:23Z","body":"It looks like IdentityServer is trying to pull in an encryption certificate, but you don't have one. If you are storing wsfed configuration in a database, make sure the encryption certificate is set to null, not just whitespace."}}
{"actor":{"display_login":"scottbrady91"}}