Symptom

• AD FS 2.x is not able to issue tokens, and the AD FS Management console shows that it is not able to connect to the configuration database. 

• The AD FS Admin Event Log contains the following events with the following XML data:

Log Name:      AD FS 2.0/Admin
Source:        AD FS 2.0
Date:          6/7/2013 8:58:13 AM
Event ID:      102
Task Category: None
Level:         Error
Keywords:     
User:          S-1-5-21-2075080465-1328441772-1012356993-42445
Computer:      ADFS.CONTOSO.COM

The following information was included with the event:

System.InvalidOperationException: Metadata contains a reference that cannot be resolved: 'http://localhost/adfs/services/trust/mex'. ---> System.InvalidOperationException: <?xml version="1.0" encoding="utf-16"?><Fault xmlns="Receiverhttp://www.w3.org/2003/05/soap-envelope"><Code><Value>Receiver</Value><Subcode><Value xmlns:a="a:InternalServiceFaulthttp://schemas.microsoft.com/net/2005/12/windowscommunicationfoundation/dispatcher">a:InternalServiceFault</Value></Subcode></Code><Reason><Text xml:lang="en-US">The server was unable to process the request due to an internal error.  For more information about the error, either turn on IncludeExceptionDetailInFaults (either from ServiceBehaviorAttribute or from the &lt;serviceDebug&gt; configuration behavior) on the server in order to send the exception information back to the client, or turn on tracing as per the Microsoft .NET Framework 3.0 SDK documentation and inspect the server trace logs.</Text></Reason></Fault>
   at System.ServiceModel.Description.MetadataExchangeClient.MetadataReferenceRetriever.DownloadMetadata(TimeoutHelper timeoutHelper)
   at System.ServiceModel.Description.MetadataExchangeClient.MetadataRetriever.Retrieve(TimeoutHelper timeoutHelper)
   --- End of inner exception stack trace ---
   at System.ServiceModel.Description.MetadataExchangeClient.MetadataRetriever.Retrieve(TimeoutHelper timeoutHelper)
   at System.ServiceModel.Description.MetadataExchangeClient.ResolveNext(ResolveCallState resolveCallState)
   at System.ServiceModel.Description.MetadataExchangeClient.GetMetadata(MetadataRetriever retriever)
   at Microsoft.IdentityServer.Service.SecurityTokenService.MexServiceHost.RetrieveEndpointList(Dictionary`2 proxyVisibleEndpoints, Uri mexAddress)
   at Microsoft.IdentityServer.Service.SecurityTokenService.MexServiceHost.RetrieveMetadata(ServiceHost wsTrustServiceHost, Boolean proxy)
   at Microsoft.IdentityServer.Service.SecurityTokenService.MexServiceHost.Create(ServiceHost wsTrustServiceHost, Uri serviceAddress, Boolean proxy)
   at Microsoft.IdentityServer.Service.SecurityTokenService.STSService.StartSTSService(ServiceHostManager serviceHostManager, ServiceState serviceState)

and

Log Name:      AD FS 2.0/Admin
Source:        AD FS 2.0
Date:          6/7/2013 8:58:09 AM
Event ID:      277
Task Category: None
Level:         Error
Keywords:     
User:          S-1-5-21-2075080465-1328441772-1012356993-42445
Computer:      ADFS.CONTOSO.COM

The following information was included with the event:

System.TypeInitializationException: The type initializer for 'TraceUtil' threw an exception. ---> System.ArgumentException: Requested value 'verbose' was not found.
   at System.Enum.Parse(Type enumType, String value, Boolean ignoreCase)
   at System.Diagnostics.TraceSource.Initialize()
   at System.Diagnostics.TraceSource.get_Switch()
   at Microsoft.IdentityModel.DiagnosticUtil.TraceUtil.InitializeTraceEnabled()
   at Microsoft.IdentityModel.DiagnosticUtil.TraceUtil..cctor()
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.DiagnosticUtil.TraceUtil.ShutdownTracing()

Cause
 

• The Microsoft.IdentityServer.ServiceHost.exe.config file has been edited, and contains data that has caused the trace utility to throw an exception. 

• This is typically caused by having incorrect syntax in the Microsoft.IdentityServer.ServiceHost.exe.config file. 

• The most common cause of this is where customers have modified the SwitchValue parameters for diagnostic tracing, and they have entered an invalid value for SwitchValue. 

• It is important to note that the SwitchValue value is case-sensitive, so adding 'verbose' rather than 'Verbose' will cause this issue.

Resolution

• Edit the Microsoft.IdentityServer.ServiceHost.exe.config file in:

• AD FS 2.0: %programFiles%\Active Directory Federation Services 2.0\
• AD FS 2.1: %winDir%\ADFS\

• Ensure that any changes you have made to this file are syntactically correct, such as case-sensitivity and spelling of SwitchValue values in the diagnostic tracing sections of the file

More Information

Learn about configuring debug tracing for AD FS 2.x servers here.