I have setup an AD FS 2.0 along with an AD FS proxy server to provide single sign on with SAML 2.0 for a cloud based resource my organization will be using. I setup the Relying Party Trust with the metadata provide to us via a URL. Logon attempts are falling, but nothing in the logs were useful. So I enable WCF and WIF trace messages with AD FS (http://technet.microsoft.com/en-us/library/adfs2-troubleshooting-configuring-computers%28WS.10%29.aspx) and the only errors we are receiving it the following:
Log Name: AD FS 2.0 Tracing/Debug
Source: AD FS 2.0 Tracing
Date: 1/19/2011 2:03:40 PM
Event ID: 67
Task Category: None
Level: Error
Keywords: ADFSProtocol
User: <AD FS Service Account>
Computer: <FQDN Of AD FS 2.0 Server>
Description:
Failed to process the Web request because the request is not valid. Cannot get protocol message from HTTP query. The following errors occurred when trying to parse incoming HTTP request:
Microsoft.IdentityServer.Protocols.Saml.HttpSamlMessageException: MSIS7015: This request does not contain the expected protocol message or incorrect protocol parameters were found according to the HTTP SAML protocol bindings .
at Microsoft.IdentityServer.Web.HttpSamlMessageFactory.CreateMessage(HttpContext httpContext)
at Microsoft.IdentityServer.Web.FederationPassiveContext.EnsureCurrent(HttpContext context)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="AD FS 2.0 Tracing" Guid="{f1aa12b3-dba2-4cab-b909-2c2b7afcf1fd}" />
<EventID>67</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000002000</Keywords>
<TimeCreated SystemTime="2011-01-19T22:03:40.131474100Z" />
<EventRecordID>28</EventRecordID>
<Correlation ActivityID="{6F145B6B-F567-44A0-A028-76AAF333AD45}" />
<Execution ProcessID="2464" ThreadID="2760" ProcessorID="0" KernelTime="60" UserTime="96" />
<Channel>AD FS 2.0 Tracing/Debug</Channel>
<Computer><FQDN Of AD FS 2.0 Server </Computer>
<Security UserID="S-1-5-21-1838089955-1065252868-413607797-8745" />
</System>
<UserData>
<Event xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://schemas.microsoft.com/ActiveDirectoryFederationServices/2.0/Events">
<EventData>Failed to process the Web request because the request is not valid. Cannot get protocol message from HTTP query. The following errors occurred when trying to parse incoming HTTP request:
Microsoft.IdentityServer.Protocols.Saml.HttpSamlMessageException: MSIS7015: This request does not contain the expected protocol message or incorrect protocol parameters were found according to the HTTP SAML protocol bindings .
at Microsoft.IdentityServer.Web.HttpSamlMessageFactory.CreateMessage(HttpContext httpContext)
at Microsoft.IdentityServer.Web.FederationPassiveContext.EnsureCurrent(HttpContext context)</EventData>
</Event>
</UserData>
</Event>
From what I can figure out, MSIS7015 simply a catchall error when AD FS 2.0 can’t handle a SAML2 message. Any suggestions on how to troubleshoot this and figure out what AD FS does like about the SAML request?