AD FS 2.0 Authentication loop

We have set up a few SSO services in AD FS 2.0 and one is limited by group membership due to license issues.
If a user not a member of the group tries to log on they end up in a loop and event log is filled with thousands of
"The caller is not authorized to request a token for the relying party ''. Please see event 501 with the same instance id for caller identity. " events.
How can we block this loop from happening?

Hi, your SaaS provider is sending a redirect for authentication the first time. That is correct. So ADFS is going through the issuance authorization rules and does not generate SAML token because the user is not in the right group. So then this answer goes
back to your SaaS provider and he is asking then ADFS again, and again,.. for authentication. So that is the explanation but not the solution for you. I had this before and the SaaS provider made some changes to prevent looping or in other cases they never
ran into.
This post should be moved to the ADFS forum - http://social.msdn.microsoft.com/Forums/vstudio/en-US/home?forum=Geneva
Regards,
Lutz

Similar Messages

Endless authentication loop

Archive and installed Panther and all the updates. Now when I launch Dreamweaver it brings up an admins authentication box. I input the correct user data and PSW and the box pops back 3 seconds later asking the same thing. I'm caught in an endless loop and cant access DREAMWEAVER!!
I checked DW's permissions and they are correct. I threw away what I thought were DW's preferences and still no avail. I ran disk utility to repair permissions, nothing.
Help!
Thanks in advance!!
PS-No other app gives me this loop of panther authentication!

Dreamweaver has an update to rid this problem.

SQL Developer SVN Authentication Loop

Hi All,
I am using SQLDeveloper 1.5.1 and I have been excited for the SVN functionality since SQLDeveloper was released.
When I connect to my svn repository, if I test the read access - the authentication prompt for the password just keeps popping up - despite putting in the correct password.
In the past I have used Tortoise w/o any issues like this, however now I am responsible for implementing source control across the team at large. I would much prefer that the team use SQLDeveloper and SVN inline rather than any alternative.
Despite the correct information - if I forget the test and just try to check out my repository - the same behavior occurs, however when I cancel the password prompt - i receive this stacktrace in my details:
org.tigris.subversion.svnclientadapter.SVNClientException: org.tigris.subversion.javahl.ClientException: svn: authentication cancelled
     at org.tigris.subversion.svnclientadapter.javahl.AbstractJhlClientAdapter.checkout(AbstractJhlClientAdapter.java:233)
     at oracle.jdevimpl.vcs.svn.op.SVNOperationCheckout$CheckoutThread.executeCheckout(SVNOperationCheckout.java:541)
     at oracle.jdevimpl.vcs.svn.op.SVNOperationCheckout$CheckoutThread.executeCheckoutWithProgress(SVNOperationCheckout.java:496)
     at oracle.jdevimpl.vcs.svn.op.SVNOperationCheckout$CheckoutThread.run(SVNOperationCheckout.java:346)
Caused by: org.tigris.subversion.javahl.ClientException: svn: authentication cancelled
     at org.tigris.subversion.javahl.JavaHLObjectFactory.throwException(JavaHLObjectFactory.java:435)
     at org.tmatesoft.svn.core.javahl.SVNClientImpl.throwException(SVNClientImpl.java:1311)
     at org.tmatesoft.svn.core.javahl.SVNClientImpl.checkout(SVNClientImpl.java:363)
     at org.tigris.subversion.svnclientadapter.javahl.AbstractJhlClientAdapter.checkout(AbstractJhlClientAdapter.java:224)
     ... 3 more
Caused by: org.tmatesoft.svn.core.SVNCancelException: svn: authentication cancelled
     at org.tmatesoft.svn.core.internal.wc.SVNErrorManager.error(SVNErrorManager.java:51)
     at org.tmatesoft.svn.core.internal.wc.SVNErrorManager.error(SVNErrorManager.java:40)
     at org.tmatesoft.svn.core.internal.io.dav.DAVUtil.findStartingProperties(DAVUtil.java:124)
     at org.tmatesoft.svn.core.internal.io.dav.DAVUtil.getBaselineProperties(DAVUtil.java:197)
     at org.tmatesoft.svn.core.internal.io.dav.DAVUtil.getBaselineInfo(DAVUtil.java:160)
     at org.tmatesoft.svn.core.internal.io.dav.DAVRepository.getLatestRevision(DAVRepository.java:150)
     at org.tmatesoft.svn.core.wc.SVNBasicClient.getRevisionNumber(SVNBasicClient.java:348)
     at org.tmatesoft.svn.core.wc.SVNBasicClient.getLocations(SVNBasicClient.java:462)
     at org.tmatesoft.svn.core.wc.SVNBasicClient.createRepository(SVNBasicClient.java:418)
     at org.tmatesoft.svn.core.wc.SVNBasicClient.createRepository(SVNBasicClient.java:382)
     at org.tmatesoft.svn.core.wc.SVNUpdateClient.doCheckout(SVNUpdateClient.java:305)
     at org.tmatesoft.svn.core.javahl.SVNClientImpl.checkout(SVNClientImpl.java:360)
     ... 4 more
It just reports an error on cancel so I don't know if that helps.
But I need help, much obliged.
Thanks,
~tim

Hey Dedwards,
I sat down with our release engineer and chased the logs - in the apache dump - same kind of stuff.
However - after changing my password, and then killing TSVNCache.exe (despite both SQLDev and Tortoise not running) I was able to connect.
Hope this helps others, thanks for the response.
~tim

Authentication loop: Advanced Help Needed

I just received my Core 2 duo 20" and I expected that connecting to my universities wireless network would be a breeze, but boy was a wrong. The network uses the following credentials, WPA, PEAP, TKIP MSchapV2. By reading /var/log/system.log I see that it authenticates fine for about 5 seconds, then stops and repeats the process over and over and over. My powerbook works 100% with the identical configuration. I suspect it's something to do with apple using new broadcom chipsets in the new imac, supporting 802.11n. I've spent hours today with my university tech support dept and they were at a loss. Thanks for any help. I am running all new drivers (updated via ethernet) and 10.4.8. Attached are my errors in /var/log/system.log
Sep 29 11:01:08 derek-leblanc-s-computer eapolclient[670]: eapmschapv2successrequest: successfully authenticated
Sep 29 11:01:13 derek-leblanc-s-computer kernel[0]: SetCryptoKey T: len 32, idx 0
Sep 29 11:01:13 derek-leblanc-s-computer kernel[0]: SetCryptoKey R: len 32, idx 1
Sep 29 11:01:13 derek-leblanc-s-computer kernel[0]: SetCryptoKey R: len 32, idx 1
Sep 29 11:01:13 derek-leblanc-s-computer kernel[0]: SetCryptoKey R: len 32, idx 1
Sep 29 11:01:17 derek-leblanc-s-computer eapolclient[670]: eapmschapv2successrequest: successfully authenticated
Sep 29 11:01:22 derek-leblanc-s-computer kernel[0]: SetCryptoKey T: len 32, idx 0
Sep 29 11:01:22 derek-leblanc-s-computer kernel[0]: SetCryptoKey R: len 32, idx 1
Sep 29 11:01:22 derek-leblanc-s-computer kernel[0]: SetCryptoKey R: len 32, idx 1
Sep 29 11:01:22 derek-leblanc-s-computer kernel[0]: SetCryptoKey R: len 32, idx 1
Sep 29 11:01:23 derek-leblanc-s-computer eapolclient[670]: eapmschapv2successrequest: successfully authenticated

Same problem!!! and with iMac Core 2 Duo and Core DUO; the use the same Airport firmware revision 4.80.46.0.
It seems a bug . Conataced Apple online support and sent email of the log.
They are escalating the problem.
I hope to have a solution soon.

Cinnamon WiFi authentication loop

So I just did a fresh install of Arch Linux with Cinnamon DE. Then I tried connecting to WiFi (yes I installed gnome-keyring) with NetworkManager with:
sudo systemctl stop dhcpcd.service
sudo systemctl disable dhcpcd.service
sudo systemctl stop dhcpcd.service
sudo systemctl disable [email protected]
sudo systemctl stop [email protected]
sudo systemctl enable NetworkManager
sudo systemctl start NetworkManager
This then shows me all the WiFi network available in my proximity. When I try to connect to my WiFi, I'm prompted with the authentication password. I enter my password correctly and it attempts to connect. Then a few seconds later, it prompts for my password again. It does not say I entered my password wrong, just prompts the password again.
Anyone help?
Thank you

|Leavism wrote:
FNtastic wrote:
I use Network Manager and cinnamon. I don't use gnome-keyring. I never get prompted for the WiFi password. Try without gnome-keyring and see if that helps...
EDIT: I also noticed that you stopped and removed the dhcpcd service for what looks like your ethernet connection (wired). And I don't see that you used the command to remove your WiFi card from the dhcpcd service. This may or may not be causing an issue, but I wanted to point it out.
Wait if you don't ever get prompt for your WiFi password, how do you connect to a WiFi with a password? Does your WiFi not have a password for security?
I still get the initial prompt. If you want, you can also right-click the network manager applet icon and "Edit connections" then select the network and change the password with "Edit"...

Email authentication looping

Have gmail and shaw email accounts set up for synch, with user name/ID and password saved for both.
When using "Messages", gmail mails display without problems. Shaw.ca asks for name/PW before each new session, AND at variable intervals (between reading, when deleting, etc.) After entering name/PW again, continues working - sometime for 2 seconds, sometime for 20, before asking again.
Any help?
Thanks.

I don't know how to do that. Likely it's possible, but I doubt that it's easy.
The IMAP protocol provider supports the SASL API, and you can probably
plug in smart card support underneath the SASL API, but I don't know
what's involved in doing that. Other than that, you would probably have
to modify JavaMail to add such support.

CNA 5.8.7 can't reset authentication after "authentication failed"

I have had a successful setp up of a community in CNA 5.8.7. I went to include another new device (add to community) that had a different authentication than all the other community switches. In adding the device I added by attempting with wrong credentials and got the "authentication failed" for the right reason. When I discovered the correct credentials I again attempted to re-add the device and I keep getting "authentication failed" without the opportunity to reauthentciate with my newly discovered credentials. An authentication loop is occuring without me being able to correct it.

Hi Anthony,
I have tried to reproduce the issue like what you have explained in issue description. CNA working fine to me.
Could you please verify device credentials once again and check wheather http/https are enabled on the device or not?
Please let me know your comments on this.
Thank you
Regards,
Srikanth Achanta

Migration Assistant: Problems transferring data from PC (XP SP3) to new Mac Pro 2012 - can not get Migration Assistant to work as PC will not display verfify passcode

Migration Assistant: Problems transferring data from PC (XP SP3) to new Mac Pro 2012 - can not get Migration Assistant to work as PC will not display verfify passcode
Hello, I am having problems migrating data from my old PC running XP (SP3) to my new Mac Pro 2012 using the Migration Assistant.
- I downloaded and installed the Windows Migration Assistant from Apple
- My Mac recognized PC and displays passcode
- The sasscode does not show / display on my PC
- My Mac is then stuck in "authenticating" loop and the PC is stuck "waiting for Mac to connect."
- Both computers are connected on same network (have connected PC on WIFI and using ethernet to Reuter)
I have looked on support site and only response I saw says to reinstall Windows Migration Assistant (which I have done)
Any ideas? If cant get this to workare there instructions for manually bring across relevant data eg itunes music and apps, photos, picasa data etc?

Why not turn off the Windows firewall and uninstall any other firewall software you have installed?
If you are using a Norton product uninstall it and discard it. To fully unistall most Norton products you have to go to the Norton website and download a soecial program to completely get rid of it. The normal uninstall feature built into the program will not remove all of it.

Dynamic VLAN-Assignment from RADIUS with Aironet 1242AG doesn't work properly

Hello All,
our setting is to assign VLANs dynamically from RADIUS (freeradius) to Clients connected to the 1242 Access-Points with one SSID. We have Firmware
12.4(10b)JA/JDA on the Aironet 1242.
The clients should be connected to one of three VLANs - one for staff, one for students and one for guests. I use the Web-Interface of
the 1242, because I'm not very familiar with IOS cli.
After assigning the first VLAN to the SSID -> click Accept, assigning the second VLAN to the SSID (overwriting the previous one) -> click Accept,
assigning the third VLAN to SSID (overwriting again) -> click Accept, the assignment of VLANs works really fine,
(the only thing i change on the page is VLAN, the SSID is set to mandatory WPAv2)
BUT...
when the 1242 is rebooted (due a building power off or similar) it doesn't work anymore. Clients end up in an endless authentication loop.
After doing the procedure again from above - assigning all VLANs sequently once, it works fine again ! till next reboot...
All VLANs have same encryption, cypher, TKIP+AES CCM. On the Cisco-Site I found a command, which i also tried with no success:
'aaa authorization network default group radius'.
I also tried to save the working config and load it into the 1242 again, this also did not work.
It seems that i'm doing something wrong, but what ?
Thanks for some help,
Frank

All you really need to do is make sure the subinterfaces/vlans are created for each VLAN you need, then have radius push down IETF attributes 64, 65, and 81.

NAC L2 OOB VG with Nortel Phones

Hi,
Will users behind the Nortel IP phones be authenticated by NAC in L2 OOB VG mode.
thanks
sathappan

Yes, assuming that the relevant switch ports are controlled by the CAM. Make sure that the phones are excluded from authentication by their MAC addresses (work out some valid prefix and exclude them from authentication) otherwise you will see authentication loops.
HTH

OS X Remote Desktop is not working with Azure Cloud Machines or Azure Pack Machines

Hi,
i can't connect to any Machine via Console. I'm Working with Machines in Azure Pack and in Cloud. The connection causes a Authentication Loop.
Best Regards

Hi,
In addition, here are some related Azure forums below for you:
Azure Virtual Machines Forum
https://social.msdn.microsoft.com/Forums/en-US/home?forum=WAVirtualMachinesforWindows&filter=alllanguages
Azure Management Portal Forum
https://social.technet.microsoft.com/forums/azure/en-US/home?forum=windowsazuremanagement&filter=alltypes&sort=lastpostdesc
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

FedAuth cookie expiration ADFS in SharePoint 2010

I have the follow situation: TokenLifetime on ADFS STS for SharePoint setted for 10 hours and the LogonTokenCacheExpirationWindow on SharePoint setted to 1 minute.
But I see from time to time that after 2 hour user may be redirected to ADFS STS. We have NLB on our solution, may be SPTokenCache not adopted to work with NLB? The Affinity on the NLB Servers is set with single. We have users
randomly be redirected back to a login page. We make use of Persistent cookies.
Sometimes the users end up in an authentication loop that causes ADFS to halt the request because of a perceived denial of service (DOS) attack, as the note states.
If i look at a trace of the activity, i see SharePoint setting the fedauth cookie has an expired value, and start making the requests again to ADFS, which then, for reasons which are still unclear to me, either won’t issue
you a non-expired cookie, or SharePoint looks at and transforms it to an expired cookie. That’s what kicks off that DOS cycle I described above.
I don't get it because i USE SINGLE AFFINITY WITH WINDOWS LOAD BALANCER! Please help :(
jtjscholten

Hi jtjscholten,
Before sending a new FEDAUTH cookie back to the user’s browser, SharePoint calculates the expiration of the cookie with the following formula:
SAML Token Lifetime – Logon Token Cache Expiration Window
For example, if ADFS sets the SAML Token Lifetime to 10 minutes and Logon Token Cache Expiration Window is set in the STS as 2 minutes then the overall SharePoint session lifespan is 8 minutes.
And if (TokenLifeTime - LogonTokenCacheExpirationWindow) =< 0 then you get a loop.
For your issue, please take steps as below:
Try below command on ADFS server:
Add-PSSnapin Microsoft.ADFS.PowerShell
Set-AdfsRelyingPartyTrust –TargetName "[ourrelayingpartytrustreference]" –TokenLifeTime 10
Stop and start the ADFS server(do not restart it. Manually stop and start it)
Then run below command on sharepoint server
$sts = Get-SPSecurityTokenServiceConfig
$sts.LogonTokenCacheExpirationWindow = (New-Timespan -Minutes 1)
$sts.Update()
iisreset
Reference:
http://social.technet.microsoft.com/Forums/en-US/f8d0fa27-2044-47c1-8dbd-0cf6dfb49942/fedauth-cookie-intermittently-set-as-persistent-cookie?forum=sharepointadmin
http://msdn.microsoft.com/en-us/library/hh147183.aspx
http://technet.microsoft.com/en-us/library/jj219795(v=office.15).aspx
Best Regards,
Eric
Eric Tao
TechNet Community Support

HT2518 Trouble Verifying Passcode when migrating from PC

Migrating from PC to Mac with Migration Assistant
- Mac recognized PC name
- Passcode does not show on PC
- Mac stuck in "authenticating" loop
- PC stuck "waiting for Mac to connect."
- both are connected to eachother through a time capsule
Ideas?

Migration Assistant - Transferring data from Mac to PC - PC will not display verfify passcode
Hello, did anyone resolve this? Same problem:
Migrating from PC to Mac with Migration Assistant
- Mac recognized PC and displays passcode
- Passcode does not show / display on PC
- Mac stuck in "authenticating" loop
- PC stuck "waiting for Mac to connect."
- both are connected on same network (have connected PC on WIFI and using ethernet to Reuter
The response above re Windows Migration Assistant is not particularly helpful as you download and install a new version when you buy mac
Any ideas? If cant get this to work is there anyway to manually bring across data eg itunes?

My app store is not working after installing mavericks. When I open app store it repeatedly asking me to login with apple ID and to provide User name and Password for proxy authentication in a loop.I am a newbie to mac,Please help me.

My app store is not working after installing mavericks. When I open app store it repeatedly asking me to login with apple ID and to provide User name and Password for proxy authentication in a loop.I am a newbie to mac,Please help me.

Hmmmm... would appear that you need to be actually logged in to enable the additional menu features.
Have you tried deletting the plists for MAS?
This page might help you out...
http://www.macobserver.com/tmo/answers/how_to_identify_and_fix_problems_with_the _mac_app_store
Failing that, I will have to throw this back to the forum to see if anyone else can advise further.
Let me know how you get on?
Thanks.

LDAP/Authentication infinite loop

My authentication provider uses an LDAP call to retrieve a data source via JNDI.
The LDAP call apparently triggers a security check/login which then calls my
getLoginModuleConfiguration() which again attempts to retrieve the data source.
Infinite loop.
How do I stop this from happening?
If the code that is executing is part of the security framework and is in an obviously
thread with access, why is this login occurring and how can we stop it?
Thank you.
Frederick N. Brier

I found this article in spanish ( fortunately I speak and write it), where saids how I can solve this problem.
[http://oracleradio.blogspot.com/2011/09/solucionando-el-ciclo-infinito-en.html]
The problem was the :
<app-role>
<name>anonymous-role</name>
<class>oracle.security.jps.internal.core.principals.JpsAnonymousRoleImpl</class> // this Class was the problem<display-name>anonymous-role</display-name>
</app-role>You need reemplace that Class for : *"oracle.security.jps.service.policystore.ApplicationRole"*
like this :
<app-role>
<name>anonymous-role</name>
<class>oracle.security.jps.service.policystore.ApplicationRole</class><display-name>anonymous-role</display-name>
</app-role>And the Anonymous and all the Roles will work Fine !!

AD FS 2.0 Authentication loop

Similar Messages

Maybe you are looking for