Getting AADSTS50020 error on microsoft login page when using Azure Active Directory Authentication

We have implemented Azure Ad single sign on using auto generated code from Visual studio 2013 with organization account authentication and its working fine.
The problem is when user is logged in in azure management portal with his live account and in other tab he try to open our app, then he directly gets below error on Microsoft login page.
Additional technical information:
Correlation ID: 78e13474-6f92-40ec-b463-91e36a6dae84
Timestamp: 2015-04-14 12:27:20Z
AADSTS50020:
User account '[email protected]' from external
identity provider 'live.com' is not supported for application
'https://xxxxx.onmicrosoft.com/xxxx'. The account needs to
be added as an external user in the tenant. Please sign out and sign in
again with an Azure Active Directory user account.
It works fine if I log out from management portal. Is there any way to resolve this issue without forcing user to log out from live account(management portal)?

I assume you created a web application using VS2013 which uses the WS-Federation protocol.
The behavior that you are seeing is expected Single-sign-on because you are logged in using the live account in the management portal.
For WS-Federation, there is no current way for a caller to specify they want to force a fresh login, so the behavior is always the equivalent of LoginBehavior.Normal.
The user will need to either sign-out or use an in-private session in the browse.
If you switch to openID connect(sample at
https://github.com/AzureADSamples/WebApp-OpenIDConnect-DotNet) and use the “prompt=login” query paramerter in the sign in request, this will force a fresh login.

Similar Messages

Error on microsoft login page for OpenId authentication using Azure AD

We have implemented authentication for multi tenant SaaS solution which uses Azure Ad single sign on using OpenIdConnect authentication and its working fine.
The problem is when user is logged in in azure management portal with his live account and in other tab he try to open our app, then he directly gets below error on Microsoft login page.
Additional technical information:
Correlation ID: 78e13474-6f92-40ec-b463-91e36a6dae84
Timestamp: 2015-04-14 12:27:20Z
AADSTS50020:
User account '[email protected]' from external
identity provider 'live.com' is not supported for application
'https://xxxxx.onmicrosoft.com/xxxx'. The account needs to
be added as an external user in the tenant. Please sign out and sign in
again with an Azure Active Directory user account.
This works fine if I will pass "prompt=login" query string parameter in sign in request, But in that case single sign on is not working. Is there any way to resolve this issue
without loosing single sign on experience?

Hello,
Have you tried the steps suggested by
Imtiaz Hussain in the
previous thread you queried ?
Is the error the same that you were previously encountering ?
Regards,
Neelesh.

Mobile account login delay when offline from Active Directory

We're getting a few MacBook Pros setup with our AD domain. All is well while on the network, but when traveling, it takes our users about 20-30 seconds to login, presumably because the client is trying to authenticate against a domain controller. Accounts are setup as mobile accounts so the credentials are cached locally.
It's frustrating that a solution isn't more readily published by Apple given how common a use case this is. It shouldn't be buried somewhere in a forum.

I figured it was because AD was somehow being looked up. I got it nailed down the the wireless connection. Turning off the AirPort connection is not a viable option as not all users are savvy enough, or remember to turn it off before taking their laptop home. One instructor was setup this way and she's isn't happy with the "resolve".
On further research, I have determined a plausible solution, at least with Mac OS 10.4.7. I haven't tested anything earlier. Open the System Preferences and then Network. Show the AirPort configuration, then click on the Option button located next the checkbox to show the AirPort status in the menu bar. There's a checkbox in there to "Disconnect from wireless networks when I log out." By checking this, the wireless connection will be disconnected but the card will remain on. This will force the computer to use the cached credentials on log in. When the user logs in, the computer will attempt to reestablish a connection with the wireless network.
I'll let you know if this works with other Macs as well.

How to get login page when user clicks on browser's back button

Hi,
I am using struts framework.
I have set property nochache=true in response header of all pages.
So, browser does not caches my pages.
Now,when I am clicking on browser's back button, I am getting following message..generated by browser.
Warning: Page has Expired The page you requested was created using information you submitted in a form. This page is no longer available. As a security precaution, Internet Explorer does not automatically resubmit your information for you.
To resubmit your information and view this Web page, click the Refresh button.
Instead of that I want to show user a login page, when it clicks on back button.
Can anyone help me?

Hi,
I agree with your suggestion.But my query is,
If you have seen many credit card or banking websites,generally when user clicks on browser's back button,its redirectly user to login page of it for security reasons.
I want to implement that kind of functionality.So need help on that point

Authorization Error on Peoplesoft Login Page

Hi, this is related to the previous project we are still working on.
Invoking a Java Method from Peoplecode
While we have found that our approach have been successful in Dev and Test Environments, once we migrated the changes to Production, it seem to have stoppped working. Our client wants to test the link from Test Environment and would Single Sign On to the Production environment. But we are getting this eror, Authorization Error -- Contact your Security Administrator on the Peoplesoft login page when the link is clicked from the Third Party website.
The node setup for Dev, Test and Prod environments under Node Definitions are using PSFT_CR as the default local node and are all working when ping'ed. The defaut user that is used for allowing public access in the Web Profile are setup'ed just the same in all three environments, and application/web servers have been restarted as well.
One thing we noticed is that the url of the third party website is http and the url for the PS prod is https. Could this be the one causing the error, or have we missed something on the setup.
Again, we appreciate your insights regarding this.
Edited by: Jeremy Leung on Jul 9, 2012 11:50 PM

Hello,
Have you tried the steps suggested by
Imtiaz Hussain in the
previous thread you queried ?
Is the error the same that you were previously encountering ?
Regards,
Neelesh.

Internal Server Error while accessing login page.

Hi,
We have recently upgraded our database from 9.2.0.8 to 11.2.0.3 on AIX 6.1 platform (EBS version 11.5.10.2). We are not able to get the login page and receiving Internal Server Error on the login page without any error messages.
On checking we have found following errors in mod_jserv.log:
[25/10/2013 05:53:42:935] (ERROR) ajp12: Servlet Error: java.lang.NoClassDefFoundError: oracle/apps/fnd/sso/SessionMgr: oracle/apps/fnd/sso/SessionMgr
[25/10/2013 05:53:42:935] (ERROR) an error returned handling request via protocol "ajpv12"
[25/10/2013 05:53:42:935] (INFO) balance: continuing to ibmapptest:16070
[25/10/2013 05:53:42:935] (ERROR) balance: 12386336 internal servlet error in server ibmapptest:16070
[25/10/2013 05:53:42:935] (ERROR) an error returned handling request via protocol "balance"
We tried clearing the cache directories and bounced Apache but that dint help.
Why would we be receving this error and how to resolve it?

OK, this is an all too common issue - the logs are insufficient so you may well have to try some extra debugging to properly understand the problem.
If you have Metalink access try this: NOTE.249669.1 How To Collect Apache and Jserv Debugging
Basically, you should do the following - and maybe upload the logs here if you want to. I assume you are on 11.5.10. If not, then amend as appropriate:
Enable de-bug for Apache and Jserv:
1. Shut down the oracle application server.
2. Backup or change the name of the following files:
IAS_ORACLE_HOME/Apache/Apache/logs/error_log
IAS_ORACLE_HOME/Apache/Apache/logs/error_log_pls
IAS_ORACLE_HOME/Apache/Apache/logs/access_log
IAS_ORACLE_HOME/Apache/Jserv/logs/mod_jserv.log and jserv.log
After making a copy of these files or after renaming them, please delete
them from these directories. This enables new log files to be created
when the applications server is restarted and will help you to focus on
the current problem.
3. Enable debug logging for Apache
Update IAS_ORACLE_HOME/Apache/Apache/conf/httpd.conf to set the LogLevel parameter:
LogLevel debug
4. Enable debug logging for Jserv and mod_jserv
a) Update iAS_ORACLE_HOME/Apache/Jserv/etc/jserv.conf to set ApJServLogLevel parameter to:
ApJServLogLevel debug (from warn)
b) Update iAS_ORACLE_HOME/Apache/Jserv/etc/jserv.properties to set the
log=true
log.channel.info=true
5. Enable debugging in ssp_init.txt
Update iAS_ORACLE_HOME/Apache/Jserv/etc/ssp_init.txt to add Debug:
DebugLevel=5
DebugSwitch=ON
6. Please re-start the application server
7. Reproduce the problem
8. Upload the following files:
IAS_ORACLE_HOME/Apache/Apache/conf/apps.conf and httpd.conf
IAS_ORACLE_HOME/Apache/Apache/logs/error_log_pls
IAS_ORACLE_HOME/Apache/Apache/logs/error_log and access_log
IAS_ORACLE_HOME/Apache/Jserv/logs/mod_jserv.log and jserv.log
IAS_ORACLE_HOME/Apache/Jserv/logs/jvm (all files in this directory)
DA

I am unable to log into the server wiki. I can get as far as the login page.

When I attempte to log into our company server wiki I can get as far as the login page.
When I type in any user/pass all I see is a spinning wheel on the login panel.
The error that is occuring in the back ground is as follows
ActiveRecord::StatementInvalid in LoginController#plain_login
SQLite3::SQLException: attempt to write a readonly database: INSERT INTO "users" ("uid", "created_at", "shortname", "longname", "generated_uid", "updated_at") VALUES (...)
I have confirmed that the postgres server for collab is running and I am able to connect to it through a Database Utility. I can also verify through this database utility that the Wiki is in tact. I do not know where else to go form here or if the errors I am seeing are not related to the wiki.
I am open to any possible assistance through this endeavor. I am running a Mac OS X server version 10.7.5.

Thank you so much. I deleted all of the Netflix history and the cookie. and it works fine now. Thank you again.

When I try to activate my home sharing on iTune I get this error message."home sharing could not be activated because an error occurred(-2146762487)" .How can I solve this problem?

When I try to activate my home sharing on iTune I get this error message."home sharing could not be activated because an error occurred(-2146762487)" .How can I solve this problem?

I have a brand new iMac with all the newest updates etc etc, Safari logs me in without any problem but iTunes etc is just not working.. and I have the same message...Any ideas how to resolve this?
"Home Sharing could not be activated because an error occurred (5506)."

When I try to install Adobe Acrobat XI Pro, I get an error message, "Key not valid for use in specified state". What is this?

When I try to install Adobe Acrobat XI Pro, I get an error message, "Key not valid for use in specified state". What is this?

See if this post by turingtest2 fixes it : key not valid for use in specified state

I'm getting an error Out of memory message when I try to render - There's lots of memory

I'm getting an error Out of memory message when I try to render - there's lots of memory and I've never gotten this before - any ideas?

Thanks - I did go through and change all the profiles to Apple RGB, there are several to choose - but I'm still having problems - I think it has to do with corrupt images - Im backing up and starting over - I've worked with images large and small for years and never had this problem - thanks

Why am i getting an error 1327 invalid drive f, when I try to setup adobe cs2?

why am I getting an error 1327 invalid drive F, when I am setting up cs2?

http://help.lockergnome.com/windows/Error-1327-Invalid-Drive--ftopict447642.html

I keep getting an error message saying, "cannot record" when trying to record over a slide in my presentation. No idea why. Any suggestions? Thanks

I keep getting an error message saying, "cannot record" when trying to record over a slide in my presentation. No idea why. Any suggestions?
Thanks

email ituens at expresslane.apple.com and they will help you for nothing

I keep getting internet explorer cannot display web page when trying to download itunes. This only shows on half the page where the download link would be. My internet connection is fine.

I keep getting internet explorer cannot display web page when trying to download itunes. This only shows on half the page where the download link would be. My internet connection is fine. Any idea what the problem may be?

You won't see anything obviously related to iCloud, Jimmy. But if you go to the home iTunes Store page while logged into your iTunes Store account, you should see a Purchases link now under the Quick Links header. That's the only part of iCloud active at this time.
Regards.

HT201210 iam getting a error message code of 3194 when trying to restore iphone 4 on itunes

iam getting a error message code of 3194 when trying to restore iphone 4 on itunes

http://support.apple.com/kb/TS3694

I get the error ox80090318 with my itunes when i try to get itunes store please tell me what to do?

I get the error ox80090318 with my itunes when i try to get itunes store please tell me what to do?

http://support.apple.com/kb/TS4123
You do this; follow the article, if unsucessful call Apple Support

Getting AADSTS50020 error on microsoft login page when using Azure Active Directory Authentication

Similar Messages

Maybe you are looking for