Trouble with ADFS: SAML tokens sent with missing attribute for most test users

Question

About two months ago, I set up an ADFS server to authenticate our users for another agency's website. I granted three users access to the website (by adding them to specific combinations of AD groups), and everything seemed to be working quite well.Then last week, my boss asked me to add another user to the required groups to grant them access. I did so, and he called me back about 30 minutes later to say that the newly authorized user was unable to access the website. After entering his credentials, he receives a 'webpage cannot be displayed' error. I have since added several other users, with mixed results: a few can log in with no issue, but most receive the same error.
After corresponding with the other agency (a torturously slow process), they sent me SAML responses for two of our test users: one working, one failing. The SAML...
This topic first appeared in the Spiceworks Community

Answer 1

Hi,
>> event id 342 "-This user can't sign in because this account is currently disabled "
For this event, the following article can be referred to as reference.
Troubleshooting token acceptance problems with AD FS 2.0
https://technet.microsoft.com/en-us/library/ff641740(v=ws.10).aspx
Based on the description, for ADFS questions, it's recommended that we ask for advice in the following forum.
Claims based access platform (CBA), code-named Geneva
https://social.msdn.microsoft.com/Forums/vstudio/en-US/home?forum=Geneva
Best regards,
Frank Shen
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]