IT Team
The Catapult IT team is responsible for providing end-user and network/server infrastructure support across Catapult’s six offices. Their blog contains insights and lessons learned from supporting the IT needs of a world-class consulting company.

Cannot sign-on to Office 365   

Tags:
Technorati Tags:

If you receive the following error when trying to use single sign on with Office 365, your token signing certificate may have expired.

“There was a problem accessing the site. Try to browse the site again.”

clip_image002

Microsoft warns that this will happen:

“The token signing certificate expires every year: By default, AD FS 2.0 generates a new token signing certificate, which is a self-signed certificate, 20 days before the certificate expires each year. Certificate rollover, or generating a new certificate when the existing certificate is about to expire and then promoting it to the primary certificate, applies only to self-signed certificates that are generated by AD FS 2.0.”

“You can configure when AD FS 2.0 generates the new token signing certificate. When the certificate rollover time comes, AD FS 2.0 generates a new certificate with the same name as the expiring certificate but with a different private key and thumbprint. Once a new certificate is generated, it will remain as a secondary certificate for five days before being promoted as the primary certificate. Five days is the default period, but this is configurable.”

http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652538.aspx#BKMK_ViewCurrentSettings

In my case, our certificate was set to expire on 3/21/2012, and the 20 day mark would have been on 3/1/2012. Our single-sign on stopped working around that time.

I checked the ADFS Admin event log and sure enough, there was event ID 358 on 3/1/2012 indicating that there was a change detected in the certificates. “Requests that are served by endpoints of this service host may fail during restart”

image

Also, Event ID 335 stated “MSIS10005: Certificate rollover service has added certificate with thumbprint xx to 'Encryption' certificate collection.”

and

MSIS10005: Certificate rollover service has added certificate with thumbprint xx to 'Signing' certificate collection.

So if you see event 335 you have 5 days to proactively run the Update-MSOLFederatedDomain cmdlet before users will be unable to sign into Office 365.

On 3/6/2012, I noticed Event ID 358

“Restarting SAML Token Issuance ServiceHost. This restart is necessary because a change was detected in the certificates that this service host uses. Requests that are served by endpoints of this service host may fail during restart.”

“Restarting Issuance ServiceHost. This restart is necessary because a change was detected in the certificates that this service host uses. Requests that are served by endpoints of this service host may fail during restart. “

Followed by two event ID 335

“MSIS10004: Certificate rollover service has set certificate with thumbprint xx as primary 'Encryption' certificate.”

“MSIS10004: Certificate rollover service has set certificate with thumbprint xx as primary 'Signing' certificate.

It is deceiving because these are ‘Informational’ event ID’s instead of ‘Warning’ or Errors and therefore would not get noticed by someone monitoring the event log for problems. (I usually only look at Warnings and Errors when looking at events).

The token signing certificate does not reside in the internal certificate store on the server, so it is not possible to check the expiration date using the MMC -> Certificates snap-in. The only way I have found to find the expiration date is to check run the Get-MSOLFederationProperty cmdlet on the ADFS server.

 

Solving the problem

1. Logon to ADFS server

2. Launch the Microsoft Online Services Module for PowerShell

3. Connect-MsolService (enter) (you will be prompted for your Office 365 credentials)

4. Add-PSSnapin Microsoft.Adfs.powershell

4. Set-MSOLADFSContext  (you will be prompted to enter the computer name, type the local netbios name of the computer, ex: constosoadfs01)

5. Get-MSOLFederationProperty -DomainName catapultsystems.com (save output)

If you want to avoid doing this every year you can increase the token signing cert duration from 1 year to 10 years with this command: Set-ADFSProperties -CertificateDuration 3650

At this point if the certificate rollover has not happened, you can force it to occur with this command: Update-ADFSCertificate -CertificateType Token-Signing -Urgent

6. Update-MSOLFederatedDomain -DomainName catapultsystems.com

7. Get-MSOLFederationProperty -DomainName catapultsystems.com (compare with original output to see if serial number was updated)

8. Restart the ADFS service.

9. Logon to the Proxy server and re-run through the ADFS 2.0 configuration wizard.

 

Note: When updating the communication certificate (ex: Wildcard) you need to swap it out on both ADFS and Proxy, as well as in the IIS Bindings too.

Reference: Great article here: http://www.benjaminathawes.com/2013/07/31/how-to-renew-your-adfs-2-0-token-signing-certificate-in-sharepoint/

 
Posted by  Joe Stocker  on  3/7/2012
0  Comments  |  Trackback Url  | 3  Links to this post | Bookmark this post with:        
 

Links to this post




Pingback from  365 SSO / ADFS Guides | The-IT-Blog  on  3/30/2012  7:52 AM

Pingback from  Lync Recording Options « rubartsunifiedcommunications  on  3/30/2012  11:32 AM

Pingback from  Windows Server Backup VHD to Virtual Machine, possible?  on  4/10/2012  3:07 PM

Pingback from  XenServer to Hyper-V Conversion via WSB  on  11/2/2012  6:58 PM

Pingback from  WSB not recovering  on  11/25/2012  1:07 PM



Pingback from  KB2813630 – Backing up VMs on Server 2012 Failover Clusters  on  2/16/2013  4:13 PM

Pingback from  VM from baremetal backup  on  3/29/2013  2:54 PM


Pingback from  Exchange 2010, Windows Server Backup (bare metal) restore?  on  11/3/2013  11:58 PM


Pingback from  Knowledge is the Key! | Exchange 2007: Export mailboxes to PST  on  2/1/2014  8:23 AM



Pingback from  IT in 2014: One Big Cloud | News In Marketing  on  3/13/2014  3:54 PM








Pingback from  Recovering Ost File Outlook 2007 | OutlookRecoveryGuide.org  on  9/27/2014  11:08 AM

Pingback from  Recovering Outlook Ost File | OutlookRecoveryGuide.org  on  9/27/2014  2:54 PM

Pingback from  ADFS stops functioning ( yearly issue ) | Bart Vincke's Blog  on  10/15/2014  9:20 AM

Comments

Name *:
URL:
Email:
Comment:


CAPTCHA Image Validation