ID4220 SAML Assertion is either not signed or the signature's KeyIdentifier cannot be resolved to a SecurityToken. Please help!

Question

Hi Everyone,
I really would appreciate some help or pointers on my situation. I have a SharePoint 2013 farm, 1 server is the DC and runs SQL, the other is the WFE Server with SharePoint and ADFS. I've configured Active Directory Certification Services and followed an
excellent ADCS blog here. 
I've gone ahead and configured ADFS and believe my Certificates to be sound as I have no warnings or anything for the Service Communication, Token Signing nor Token Decrypting Certificate. Below are my certs.
I also configured the trusted relying party following numerous blogs (I did this a couple of times to make sure I didn't do anything wrong) but followed this blog.
My Adfs RP looks like this:
Upon configuring the relying trust for me SharePoint Web Application, I used a powershell script, added 3 claim mappings and specified the exported token signing certificate as the main certificate. Running Get-SPTrustedIdentityTokenIssuer I can confirm
that I've added the Token Issuer, what I believe to be correct:
ProviderUri                   : https://adfsportal.mvdb.com/adfs/ls/
DefaultProviderRealm          : urn:sharepoint:adfs
ProviderRealms                : {}
ClaimTypes                    : {http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn, 
                                http://schemas.microsoft.com/ws/2008/06/identity/claims/role, 
                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress}
HasClaimTypeInformation       : True
ClaimTypeInformation          : {Email Address, Account ID, Role}
ClaimProviderName             : 
UseWReplyParameter            : False
UseWHomeRealmParameter        : False
RegisteredIssuerName          : 
IdentityClaimTypeInformation  : Microsoft.SharePoint.Administration.Claims.SPTrustedClaimTypeInformation
Description                   : ADFS SAML Provider
SigningCertificate            : [Subject]
                                  CN=tokensigning.adfs.mvdb.com
                                [Issuer]
                                  CN=mvdb-MVDBPRIME-CA, DC=mvdb, DC=com
                                [Serial Number]
                                  24000000036DEE002044F8EC45000000000003
                                [Not Before]
                                  2014-03-24 10:35:17 AM
                                [Not After]
                                  2016-03-23 10:35:17 AM
                                [Thumbprint]
                                  ED85DB5F1FF564FD7F645E365EB52C2DB406B825
AdditionalSigningCertificates : {}
MetadataEndPoint              : 
IsAutomaticallyUpdated        : False
Name                          : SAML Provider
TypeName                      : Microsoft.SharePoint.Administration.Claims.SPTrustedLoginProvider
DisplayName                   : SAML Provider
Id                            : 2f59bcca-6ee1-43ae-b9fa-f1b415cdd58b
Status                        : Online
Parent                        : SPSecurityTokenServiceManager Name=SecurityTokenServiceManager
Version                       : 22046
Properties                    : {}
Farm                          : SPFarm Name=SharePoint_Config
UpgradedPersistedProperties   : {}
So then went and extended my Web Application, added a host header (secured with wildcard cert) and chose my trusted provider I've just added with the script. When logging on, sure enough, I get prompted with the login dropdown but as soon as I choose the
adfs option I get:
ID4220: The SAML Assertion is either not signed or the signature's KeyIdentifier cannot be resolved to a SecurityToken. Ensure that the appropriate issuer tokens are present on the token resolver. To handle advanced token resolution requirements,
extend Saml11TokenSerializer and override ReadToken
So far I have not been able to get further than this. I've double checked that I have given permissions on the token signing cert's private keys (read permissions on the ADFS service account as well as Network Service).
Please help!
-Mike

Answer 1

Hi,
According to your post, my understanding is that you got the “ID4220 SAML Assertion is either not signed or the signature's KeyIdentifier cannot be resolved to a SecurityToken” error.
I recommend to run Get-SPTrustedIdentityTokenIssuer PowerShell command on SharePoint server and look at the Trusted Identity Token Issuer to see if certificate associated was correct version of ADFS Token signing certificate.
If you export ADFS Communication Certificate for ADFS Login URL instead of ADFS Token Signing Certificate, please export the correct version of ADFS Token Signing Certificate and rerun the
following command on SharePoint Servers using SharePoint Install account to associate correct version of ADFS Signing certificate with SharePoint TrustedIdentityTokenIssuer and it should resolve the issue.
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2(“C:\Host\ADFS Signing.cer”)
$sts = Get-SPTrustedIdentityTokenIssuer
$sts | Set-SPTrustedIdentityTokenIssuer -ImportTrustCertificate $cert
More information:
SharePoint and ADFS Configuration Error – ID4220: The SAML
Assertion is either not signed or the signature’s KeyIdentifier cannot be resolved to a SecurityToken
Thanks,
Linda Li
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Linda Li
TechNet Community Support