5

I’m trying to use the free developer edition (http://developer.force.com/) of and setup a demo SAML Idp for testing with my ADFS 2.0 + SP. So far I’ve managed to enabled SAML support, and created a connected app. Everything works relatively well right up to login. After login, I’m redirected back to my ADFS but I’m facing following error

Failed to process the Web request because the request is not valid. Cannot get protocol message from HTTP query. The following errors occurred when trying to parse incoming HTTP request:

Microsoft.IdentityServer.Protocols.Saml.HttpSamlMessageException: MSIS7015: This request does not contain the expected protocol message or incorrect protocol parameters were found according to the HTTP SAML protocol bindings.

Here’s my settings of the application

Entity Id   http://staging/adfs/services/trust
ACS URL https://staging/adfs/ls/
Subject Type    User ID
Name ID Format  urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Issuer  https://ttt-dev-ed.my.salesforce.com
Service Provider Certificate

The ones I’m not sure are ACS URL and Service provider Certificate. Thoughts?

Following are salesforce related resources about setting it as Idp and associated Sp configurations. https://help.salesforce.com/apex/HTViewHelpDoc?id=service_provider_define.htm&language=en_US

Improve this question
1
  • In general, when trying to troubleshoot ADFS/SAML issues I've found it's helpful to record your network traffic with the dev tools of your browser, grab the SAML Requests/Responses and run them through a base64 decoder to check that the values you expect are being sent and received.
    – IllusiveBrian
    Commented May 20, 2017 at 16:40

1 Answer 1

Reset to default
0

We have done the similar configuration but with PingOne instead of ADFS2.0. But the steps would be same. In our case our ACS Url was like: https://sso.connect.pingidentity.com/sso/sp/ACS.saml2 and we had to upload one PingOne certificate at salesforce end for verifying request Signatures. From salesforce side we had generated a Default Idp Certificate and passed that to Ping one.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .