title: AADSTS90081: An error occurred when we tried to process a WS-Federation message. The message was invalid
body: <p>Testing WS-Federation - Passive Requestor Profile implementation in my custom STS against a federated domain in AAD using web-browser (<a href="https://outlook.office365.com/owa" rel="nofollow noreferrer">https://outlook.office365.com/owa</a>).</p>
  
  <p>I am able to HTTP-POST the response (RSTR) to <a href="https://login.microsoftonline.com/login.srf" rel="nofollow noreferrer">https://login.microsoftonline.com/login.srf</a> after successful authentication at custom STS/ IdP, but somehow following error is showing in the screen.</p>
  
  <blockquote>
    <p>Sign In</p>
    
    <p>Sorry, but we’re having trouble signing you in. We received a bad
    request.</p>
    
    <p>Additional technical information:</p>
    
    <p>Correlation ID: 245b8d44-c4a5-46fc-a8c3-427c27791863</p>
    
    <p>Timestamp: 2017-06-14 06:19:26Z</p>
    
    <p><strong>AADSTS90081: An error occurred when we tried to process a WS-Federation message. The message was invalid.</strong></p>
  </blockquote>
  
  <p>Please refer posted RSTR below.</p>
  
  <p>Also I couldn't see any audit logs corresponding to this message invalid error in <a href="https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Audit" rel="nofollow noreferrer">https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Audit</a>.</p>
  
  <p>Any idea what I am missing here? or Is there a way to see federated domain's error logs in Azure AD admin portal?</p>
  
  <p>Please advice.</p>
  
  <pre><code>wsresult = &lt;t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:wp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsa="http://www.w3.org/2005/08/addressing" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"&gt;
     &lt;t:TokenType&gt;urn:oasis:names:tc:SAML:1.0:assertion&lt;/t:TokenType&gt;
     &lt;t:RequestedSecurityToken&gt;
        &lt;saml:Assertion AssertionID="id-HwkRp-evkRNQDektd-zMdRKZ74LuDuuWhec-J9Lt" IssueInstant="2017-06-14T03:07:07Z" Issuer="urn:fed:mySts" MajorVersion="1" MinorVersion="1"&gt;
           &lt;dsig:Signature&gt;
              &lt;dsig:SignedInfo&gt;
                 &lt;dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                 &lt;dsig:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /&gt;
                 &lt;dsig:Reference URI="#id-HwkRp-evkRNQDektd-zMdRKZ74LuDuuWhec-J9Lt"&gt;
                    &lt;dsig:Transforms&gt;
                       &lt;dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
                       &lt;dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
                    &lt;/dsig:Transforms&gt;
                    &lt;dsig:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /&gt;
                    &lt;dsig:DigestValue&gt;D5DvtVT9y/tvKKK1+CmmMRL95Ogg+9lZUkGB9crTC/w=&lt;/dsig:DigestValue&gt;
                 &lt;/dsig:Reference&gt;
              &lt;/dsig:SignedInfo&gt;
              &lt;dsig:SignatureValue&gt;YEUp7GuC5qwEYUw4iKxrkezBKd8TetLiKkx63JTt6oizAzSQsLahDTlo3Pl/Na0tJEApLVMICsriZotNRQLrM9MuqI2cmYLqHGaK1LWs3euRwkT1hq6tHKuSkl7yGew4PYB/ZOVSAqHxDx1G2A3AkbYXu/IgHoeBnghdwszbYbs=&lt;/dsig:SignatureValue&gt;
              &lt;dsig:KeyInfo&gt;
                 &lt;dsig:X509Data&gt;
                    &lt;dsig:X509Certificate&gt;MIICUDCCAbmgAwIBAgIELfGcX...&lt;/dsig:X509Certificate&gt;
                 &lt;/dsig:X509Data&gt;
              &lt;/dsig:KeyInfo&gt;
           &lt;/dsig:Signature&gt;
           &lt;saml:Conditions NotBefore="2017-06-14T03:06:37Z" NotOnOrAfter="2017-06-14T03:12:37Z"&gt;
              &lt;saml:AudienceRestrictionCondition&gt;
                 &lt;saml:Audience&gt;urn:federation:MicrosoftOnline&lt;/saml:Audience&gt;
              &lt;/saml:AudienceRestrictionCondition&gt;
           &lt;/saml:Conditions&gt;
           &lt;saml:AuthenticationStatement AuthenticationInstant="2017-06-14T03:07:07Z" AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password"&gt;
              &lt;saml:Subject&gt;
                 &lt;saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"&gt;4JRuZcPlfk+syK/x5WMgbA=&lt;/saml:NameIdentifier&gt;
                 &lt;saml:SubjectConfirmation&gt;
                    &lt;saml:ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:bearer&lt;/saml:ConfirmationMethod&gt;
                 &lt;/saml:SubjectConfirmation&gt;
              &lt;/saml:Subject&gt;
           &lt;/saml:AuthenticationStatement&gt;
           &lt;saml:AttributeStatement&gt;
              &lt;saml:Subject&gt;
                 &lt;saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"&gt;4JRuZcPlfk+syK/x5WMgbA=&lt;/saml:NameIdentifier&gt;
                 &lt;saml:SubjectConfirmation&gt;
                    &lt;saml:ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:bearer&lt;/saml:ConfirmationMethod&gt;
                 &lt;/saml:SubjectConfirmation&gt;
              &lt;/saml:Subject&gt;
              &lt;saml:Attribute AttributeName="UPN" AttributeNamespace="http://schemas.xmlsoap.org/claims"&gt;
                 &lt;saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string"&gt;xyz@abc.com&lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
              &lt;saml:Attribute AttributeName="ImmutableID" AttributeNamespace="http://schemas.microsoft.com/LiveID/Federation/2008/05"&gt;
                 &lt;saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string"&gt;4JRuZcPlfk+syK/x5WMgbA=&lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
              &lt;saml:Attribute AttributeName="objectGUID" AttributeNamespace="http://tempuri.com"&gt;
                 &lt;saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string"&gt;4JRuZcPlfk+syK/x5WMgbA=&lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
           &lt;/saml:AttributeStatement&gt;
        &lt;/saml:Assertion&gt;
     &lt;/t:RequestedSecurityToken&gt;
     &lt;wp:AppliesTo&gt;
        &lt;wsa:EndpointReference&gt;
           &lt;wsa:Address&gt;urn:federation:MicrosoftOnline&lt;/wsa:Address&gt;
        &lt;/wsa:EndpointReference&gt;
     &lt;/wp:AppliesTo&gt;
     &lt;t:Lifetime&gt;
        &lt;Created&gt;2017-06-14T03:06:37Z&lt;/Created&gt;
        &lt;Expires&gt;2017-06-14T03:12:37Z&lt;/Expires&gt;
     &lt;/t:Lifetime&gt;
  &lt;/t:RequestSecurityTokenResponse&gt;
  </code></pre>