I’m trying to use the free developer edition (http://developer.force.com/) of and setup a demo SAML Idp for testing with my ADFS 2.0 + SP. So far I’ve managed to enabled SAML support, and created a connected app. Everything works relatively well right up to login. After login, I’m redirected back to my ADFS but I’m facing following error

Failed to process the Web request because the request is not valid. Cannot get protocol message from HTTP query. The following errors occurred when trying to parse incoming HTTP request:

Microsoft.IdentityServer.Protocols.Saml.HttpSamlMessageException: MSIS7015: This request does not contain the expected protocol message or incorrect protocol parameters were found according to the HTTP SAML protocol bindings.

Here’s my settings of the application

Entity Id   http://staging/adfs/services/trust
ACS URL https://staging/adfs/ls/
Subject Type    User ID
Name ID Format  urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Issuer  https://ttt-dev-ed.my.salesforce.com
Service Provider Certificate

The ones I’m not sure are ACS URL and Service provider Certificate. Thoughts?

Following are salesforce related resources about setting it as Idp and associated Sp configurations. https://help.salesforce.com/apex/HTViewHelpDoc?id=service_provider_define.htm&language=en_US

  • In general, when trying to troubleshoot ADFS/SAML issues I've found it's helpful to record your network traffic with the dev tools of your browser, grab the SAML Requests/Responses and run them through a base64 decoder to check that the values you expect are being sent and received. – IllusiveBrian May 20 '17 at 16:40

We have done the similar configuration but with PingOne instead of ADFS2.0. But the steps would be same. In our case our ACS Url was like: https://sso.connect.pingidentity.com/sso/sp/ACS.saml2 and we had to upload one PingOne certificate at salesforce end for verifying request Signatures. From salesforce side we had generated a Default Idp Certificate and passed that to Ping one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.