Single Sign On is not working for Exchange 2013 Cu12 OWA.I am trying it for the first time.
My environment has one DC collocated with ADFS 3.0 and Exchange 2013 CU12 and Exchange 2016 CU1 on separate vm box.
I have followed technet article https://technet.microsoft.com/en-us/library/dn635116%28v=exchg.150%29.aspx i am getting below event id ;However i have configured my Relying Party as Https://Mail.contoso.local/owa but i am seeing https://localhost/owa in
the event id.I am not sure why it is not redirecting to right url.DC time is synced with the exchange server in the domain.Windows Firewall
When i try to browse https://mail.contoso.local/owa i get a credential prompt from ADFS server when i enter the credentials i get 400 Bad request and when i check the ADFS event id i see the below error no error found in Exchange server.I have recreated the relying party trust and claim rule ,Rebooted the ADFS server and exchange servers same issue.But currently i want Exchange 2013 OWA single sign on to be working internally any hep is much appreciated.
Log Name: AD FS/Admin
Source: AD FS
Date: 4/15/2016 5:19:57 AM
Event ID: 364
Task Category: None
Level: Error
Keywords: AD FS
User: CONTOSO\AdfsService
Computer: FQDN.Contoso.Local
Description:
Encountered error during federation passive request.
Additional Data
Protocol Name:
wsfed
Relying Party:
https://localhost/owa/
Exception details:
Microsoft.IdentityServer.Web.InvalidScopeException: MSIS7007: The requested relying party trust 'https://localhost/owa/' is unspecified or unsupported. If a relying party trust was specified, it is possible that you do not have permission to access the trust
relying party. Contact your administrator for details.
at Microsoft.IdentityServer.Web.Protocols.WSFederation.WSFederationSignInContext.Validate()
at Microsoft.IdentityServer.Web.Protocols.WSFederation.WSFederationProtocolHandler.GetRequiredPipelineBehaviors(ProtocolContext pContext)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="AD FS" Guid="{2FFB687A-1571-4ACE-8550-47AB5CCAE2BC}" />
<EventID>364</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000001</Keywords>
<TimeCreated SystemTime="2016-04-15T09:19:57.357321000Z" />
<EventRecordID>1149</EventRecordID>
<Correlation ActivityID="{00000000-0000-0000-1D00-0080010000D9}" />
<Execution ProcessID="7000" ThreadID="6424" />
<Channel>AD FS/Admin</Channel>
<Computer>pnwvads1001.Contoso.Local</Computer>
<Security UserID="S-1-5-21-2436829481-2076273062-547070292-1157" />
</System>
<UserData>
<Event xmlns="http://schemas.microsoft.com/ActiveDirectoryFederationServices/2.0/Events">
<EventData>
<Data>wsfed</Data>
<Data>https://localhost/owa/</Data>
<Data>Microsoft.IdentityServer.Web.InvalidScopeException: MSIS7007: The requested relying party trust 'https://localhost/owa/' is unspecified or unsupported. If a relying party trust was specified, it is possible
that you do not have permission to access the trust relying party. Contact your administrator for details.
at Microsoft.IdentityServer.Web.Protocols.WSFederation.WSFederationSignInContext.Validate()
at Microsoft.IdentityServer.Web.Protocols.WSFederation.WSFederationProtocolHandler.GetRequiredPipelineBehaviors(ProtocolContext pContext)
at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)
</Data>
</EventData>
</Event>
</UserData>
</Event>
Lakz