Custom STS trust issue with SharePoint

Question

Hello,
This is my first time creating a custom STS and I've been running into some problems with it. I'm using VS 2012 on SharePoint 2013.
I have created a custom STS that I’d like to use to authenticate users to SharePoint. I created simple stand along web-application that I was using to test logging in with the STS and it seemed to work fine. The environment I’m using is as below:
A single App/WFE dev server. SQL is separate.
A custom STS site that I deployed to the server. I gave it the URL
http://customsts.dev I added an entry to the local hosts file for it.
I used PluralSight’s SelfCert 3^rd party tool to create a new certificate. I added that cert to the Trusted Root Certification Authorities and also to the SharePoint Certificates stores on the server via the MMC.
I use the certificate Key for signing the claim in the STS.
I created a sample stand-alone Non-SharePoint web site to log in using the STS and it seems to work.
dfd- Next,
I created a SharePoint web-application and called it http://servername:1111.
Next I ran the following powershell set up a new trusted identity provider in SharePoint:
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("e:\pla\customsts.dev.cer")
$map1 = New-SPClaimTypeMapping "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "EmailAddress" –SameAsIncoming
$realm = http://servername:1111/_trust/
$signinurl = https://customsts.dev/Account/Login
New-SPTrustedRootAuthority -Name “customsts.dev” -Certificate $cert
New-SPTrustedIdentityTokenIssuer -Name "customsts.dev" -Description "Passport STS" -Realm $realm -ImportTrustCertificate $cert -ClaimsMappings $map1 -SignInUrl $signinurl -IdentifierClaim $map1.InputClaimType
I set the customsts.dev as the Trusted Identity Provider for the web-app at 1111.
I noticed that when I try to log into the web-application, I get the option to pick the authentication, and then get redirected to the login page of the customsts.dev STS. When I attempt to log in, I get routed back to SharePoint and see this error in
the ULS logs:
Application error when access /, Error=The issuer of the token is not a trusted issuer. 
 at Microsoft.SharePoint.IdentityModel.SPLocalIssuerNameRegistry.GetIssuerName(SecurityToken securityToken)   
 at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.CreateClaims(SamlSecurityToken samlSecurityToken)   
 at Microsoft.IdentityModel.Tokens.Saml11.Saml11SecurityTokenHandler.ValidateToken(SecurityToken token)   
 at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ValidateToken(SecurityToken token)   
 at Microsoft.IdentityModel.Web.TokenReceiver.AuthenticateToken(SecurityToken token, Boolean ensureBearerToken, String endpointUri)   
 at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequest request)   
 at Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args)   
I have tried searching for solutions to this and seem to have exhausted all the options. Does anyone have any experience with this? I'm wondering if there's anything that I'm doing incorrectly in setting up the STS. Any help in this regard would be very
appreciated.
Thanks,
Sudharsan.

Answer 1

Hi,
the certificate you used to create trust is a self signed cert ???
if yes try this with a domain certificate.
Whenever you see a reply and if you think is helpful,Vote As Helpful! And whenever you see a reply being an answer to the question of the thread, click Mark As Answer