1

I am using ADFS in Windows Server 2012 with SAML 2.0 to implement SSO for an MVC application. I started to get this error which I am unable to find a way to solve. What am I doing wrong?

The Federation Service could not authorize token issuance for caller 'xxx\xxxx
'. The caller is not authorized to request a token for the relying party 'https://example.com/SampleMvcApplication/AuthServices'. Please see event 501 with the same instance id for caller identity. 

Additional Data 
Instance id: xyz 
Relying party: https://example.com/SampleMvcApplication/AuthServices 
Exception details: 
Microsoft.IdentityServer.Service.IssuancePipeline.CallerAuthorizationException: MSIS5007: The caller authorization failed for caller identity System.Security.Claims.ClaimsIdentity for relying party trust https://example.com/SampleMvcApplication/AuthServices.
   at System.IdentityModel.AsyncResult.End(IAsyncResult result)
   at System.IdentityModel.TypedAsyncResult`1.End(IAsyncResult result)
   at System.IdentityModel.SecurityTokenService.EndIssue(IAsyncResult result)
   at Microsoft.IdentityServer.Service.SamlProtocol.SamlProtocolService.Issue(IssueRequest issueRequest)
   at Microsoft.IdentityServer.Service.SamlProtocol.SamlProtocolService.ProcessRequest(Message requestMessage) 
User Action 
Use the AD FS Management snap-in to ensure that the caller is authorized to request a token for the relying party.
Gilligan
  • 451
  • 1
  • 5
  • 14
Dimuthu
  • 326
  • 2
  • 8
  • 25

2 Answers2

1

In the Relying Party Trust (RPT) for this service provider (SP), take a look at the Issuance Authorization Rules tab. You'll need at least one rule to issue the claim type http://schemas.microsoft.com/authorization/claims/permit with a value of true and no claims issuing the claim type http://schemas.microsoft.com/authorization/claims/deny with a value of true, though technically I don't believe any value is needed for either. If all users are allowed to the front door of your SP, you can use the rule template under Add Rule called Permit All Users.

Gilligan
  • 451
  • 1
  • 5
  • 14
1

You need to permit that user for the relying party configured in ADFS.

ADFS management -> Relying party Trusts -> Right click your relying party -> Edit claim rules -> Issuance Authorization Rules -> Add Rule -> Permit access to all users.

Bhushan Karmarkar
  • 625
  • 7
  • 22