CRM 2011 + ADFS 3.0: Requested Authentication Method is not supported on the STS.

(0) Share

Report

Posted on by MichelZ

I'm trying to get CRM 2011 to work with ADFS 3.0.

We get the following error message:

Exception details:

Microsoft.IdentityServer.Service.Policy.PolicyServer.Engine.InvalidAuthenticationTypePolicyException: MSIS7102: Requested Authentication Method is not supported on the STS.

at Microsoft.IdentityServer.Web.Authentication.GlobalAuthenticationPolicyEvaluator.EvaluatePolicy(IList`1 mappedRequestedAuthMethods, AccessLocation location, ProtocolContext context, HashSet`1 authMethodsInToken, Boolean& validAuthMethodsInToken)

at Microsoft.IdentityServer.Web.Authentication.AuthenticationPolicyEvaluator.RetrieveFirstStageAuthenticationDomain(Boolean& validAuthMethodsInToken)

at Microsoft.IdentityServer.Web.Authentication.AuthenticationPolicyEvaluator.EvaluatePolicy(Boolean& isLastStage, AuthenticationStage& currentStage, Boolean& strongAuthRequried)

at Microsoft.IdentityServer.Web.PassiveProtocolListener.GetAuthMethodsFromAuthPolicyRules(PassiveProtocolHandler protocolHandler, ProtocolContext protocolContext)

at Microsoft.IdentityServer.Web.PassiveProtocolListener.GetAuthenticationMethods(PassiveProtocolHandler protocolHandler, ProtocolContext protocolContext)

at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)

Any ideas?

Thanks

Michel

*This post is locked for comments

I have the same question (0)

All responses (12)

Answers (1)

Suggested answer

Matt Jereb 590 on at

Like (0)

Report

Hi Michel,

I wrote quick article on our website about this issue: www.celoxgroup.com.au/.../crm-2013-and-adfs-30-requested-authentication-method-not-supported-sts

community.dynamics.com/.../233831.aspx

Regards,

Matt

Was this reply helpful? Yes No
MichelZ on at

Like (0)

Report

I have to test this. We are already publishing ADFS through WAP, and it is working with other products using ADFS.

Was this reply helpful? Yes No
Verified answer

AaronRic 10,035 on at

Like (0)

Report

Also, AD FS 3.0 has not been tested for support yet with CRM 2011.

Was this reply helpful? Yes No
axtolf on at

Like (0)

Report

Hi, same problem here. CRM 2013 + ADFS 3.0 bot on w2012.

We can't find out a solution. We followed the documentation based on CRM2011 to configure them.

Anyone found a solution?

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

I opened a support case with Microsoft on this issue, and the official response was "Dynamics CRM 2013 does not [yet] support and has not been tested with Windows Server 2012 R2, therefore operation with ADFS 3.0 is not supported." The support technician suggested waiting for a Rollup that may add support for Server 2012 R2.

Was this reply helpful? Yes No
axtolf on at

Like (0)

Report

Hi, after some checking and re-checking, it works for me.

Pay attention to one detail. When you put CRM in https, if you are using the default https port, like us, do not specify it. So if your server is for example "server1.contoso.com" , you have to put https://server1.contoso.com and not server1.contoso.com

After changing with little detail, it works for us.

After making crm2013 working with ADFS 2.X , we try out adfs again, and it works too. We left ADFS exposed without using reverse proxy. We are still checking about reverse proxy.

Now we have to understand how to configure it to use APPS for mobile devices.

Was this reply helpful? Yes No
Chris@BAG 20 on at

Like (0)

Report

Today I tried to migrate our CRM 2013 IFD deployment to ADFS 2.2 (Windows Server 2012R2).

I got the same error. I solved the issue by adding "Forms Authentication" to the supported Authentication Methods for Intranet under Global Settings in the ADFS Management Shell (located under "Authenication Policies - Primary Authentication".

Now IFD is working well. But I can't get the Internal URLs working, here I'm getting the IE Credential Prompt.

Was this reply helpful? Yes No
Suggested answer

Chris@BAG 20 on at

Like (0)

Report

So, me again...

I solved the last Issue by Setting the correct spn. So everything is working now.

TODOs for getting CRM IFD / ADFS 2.2 working:

1. Setting correct SPN

2. Adding Forms Authentication to the Intranet Authentication Methods (Global Settings in the ADFS Management Shell ... located under "Authenication Policies - Primary Authentication").

Was this reply helpful? Yes No
Chris@BAG 20 on at

Like (0)

Report

One More Info: Everybody speeks about ADFS 3.0. Actually there is no ADFS 3.0, Built-In ADFS in Windows 2012R2 is ADFS 2.2

Was this reply helpful? Yes No
Chris Polewiak 10 on at

Like (0)

Report

Not True...

ADFS 3.0 is included as a built in server role in Windows Server 2012 R2

Was this reply helpful? Yes No