Hello, if possible, could you please shed light on my current issue ?
I used 3rd party MFA plug-in for ADFS server. When I enabled the plug-in module, the behavior is a little bit strange.
When I access https://login.microsoftonline.com with my federated account(using UPN) from intranet or internet, I can get the authentication from office365 with browser. however, I cannot get the authentication with Lync Application(rich client) and when I look at the event viewer of the log, I can see the following message. I tried with some of configuration change for claim rule, but I cannot find out any solution. At the same time, when I disable, this MFA module, I can get the authentication with Lync Application without any other configuration change. Thanks.
ID: 325 (error)
=========
The Federation Service could not authorize token issuance for caller 'TEST\abcde194
'. The caller is not authorized to request a token for the relying party 'urn:federation:MicrosoftOnline'. See event 501 with the same Instance ID for caller identity.
Additional Data
Instance ID: 07c80721-4562-4774-9e55-80b10776cc46
Relying party: urn:federation:MicrosoftOnline
Exception details:
Microsoft.IdentityServer.Service.IssuancePipeline.CallerAuthorizationException: MSIS5007:
The caller authorization failed for caller identity TEST\abcde194 for relying party trust urn:federation:MicrosoftOnline.
at Microsoft.IdentityModel.Threading.AsyncResult.End(IAsyncResult result)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.ProcessCoreAsyncResult.End(IAsyncResult ar)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.EndProcessCore(IAsyncResult ar, String requestAction, String responseAction, String trustNamespace)
User Action
Use the AD FS Management snap-in to ensure that the caller is authorized to request a token for the relying party.
ID: 501 (info)
========
More information for the event entry with Instance ID 07c80721-4562-4774-9e55-80b10776cc46.
There may be more events with the same Instance ID with more information.
Instance ID:
07c80721-4562-4774-9e55-80b10776cc46
Caller identity:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name TEST\abcde194
http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid S-1-5-21-1438865278-210740031-763110159-1120
http://schemas.microsoft.com/ws/2008/06/identity/claims/primarygroupsid S-1-5-21-1438865278-210740031-763110159-513
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid S-1-5-21-1438865278-210740031-763110159-513
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid S-1-1-0
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid S-1-5-32-545
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid S-1-5-2
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid S-1-5-11
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid S-1-5-15
http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid S-1-18-1
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant 2015-04-09T02:54:39.772Z
http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod
http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password
http://schemas.microsoft.com/ws/2012/01/passwordexpirationtime 2015-05-20T01:15:59.607Z
http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-user-agent
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.1; Win64; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; MSOIDCRL 7.250.4556.0; App lync.exe, 15.0.4701.0, {12B07E85-1B47-41C4-A4E2-43B0C66A0CF6})
http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-endpoint-absolute-path /adfs/services/trust/2005/usernamemixed
http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork true
http://schemas.microsoft.com/2012/01/requestcontext/claims/client-request-id 15b39ca8-0221-445b-89d4-d62259212ad0
http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-client-ip 52.68.120.128
http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname TEST\abcde194
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn abcde194@domain.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/implicitupn abcde194@test.local
ID: 1000 (err)
===========
An error occurred during processing of a token request. The data in this event may have the identity of the caller (application) that made this request.
The data includes an Activity ID that you can cross-reference to error or warning events to help diagnose the problem that caused this error.
Additional Data
Caller:
TEST\abcde194
OnBehalfOf user:
ActAs user:
Target Relying Party:
urn:federation:MicrosoftOnline
Device identity:
User action:
Use the Activity ID data in this message to search and correlate the data to events in the Event log using Event Viewer.
This Activity ID will also be shown as additional information in the error page when an error occurs in the federation passive Web application.
ID: 325 (err)
==========
The Federation Service could not authorize token issuance for caller 'TEST\abcde194
'. The caller is not authorized to request a token for the relying party 'urn:federation:MicrosoftOnline'. See event 501 with the same Instance ID for caller identity.
Additional Data
Instance ID: 6d4c79df-82b0-44ac-9d57-c95e767fac3c
Relying party: urn:federation:MicrosoftOnline
Exception details:
Microsoft.IdentityServer.Service.IssuancePipeline.CallerAuthorizationException: MSIS5007:
The caller authorization failed for caller identity TEST\abcde194 for relying party trust urn:federation:MicrosoftOnline.
at Microsoft.IdentityModel.Threading.AsyncResult.End(IAsyncResult result)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.ProcessCoreAsyncResult.End(IAsyncResult ar)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.EndProcessCore(IAsyncResult ar, String requestAction, String responseAction, String trustNamespace)
User Action
Use the AD FS Management snap-in to ensure that the caller is authorized to request a token for the relying party.