TechNet
Products
IT Resources
Downloads
Training
Support
Products
Windows
Windows Server
System Center
Microsoft Edge
Office
Office 365
Exchange Server
SQL Server
SharePoint Products
Skype for Business
See all products »
Resources
Channel 9 Video
Evaluation Center
Learning Resources
Microsoft Tech Companion App
Microsoft Technical Communities
Microsoft Virtual Academy
Script Center
Server and Tools Blogs
TechNet Blogs
TechNet Flash Newsletter
TechNet Gallery
TechNet Library
TechNet Magazine
TechNet Wiki
Windows Sysinternals
Virtual Labs
Solutions
Networking
Cloud and Datacenter
Security
Virtualization
Updates
Service Packs
Security Bulletins
Windows Update
Trials
Windows Server 2016
System Center 2016
Windows 10 Enterprise
SQL Server 2016
See all trials »
Related Sites
Microsoft Download Center
Microsoft Evaluation Center
Drivers
Windows Sysinternals
TechNet Gallery
Training
Expert-led, virtual classes
Training Catalog
Class Locator
Microsoft Virtual Academy
Free Windows Server 2012 courses
Free Windows 8 courses
SQL Server training
Microsoft Official Courses On-Demand
Certifications
Certification overview
Special offers
MCSE Cloud Platform and Infrastructure
MCSE: Mobility
MCSE: Data Management and Analytics
MCSE Productivity
Other resources
Microsoft Events
Exam Replay
Born To Learn blog
Find technical communities in your area
Azure training
Official Practice Tests
Support options
For business
For developers
For IT professionals
For technical support
Support offerings
More support
Microsoft Premier Online
TechNet Forums
MSDN Forums
Security Bulletins & Advisories
Not an IT pro?
Microsoft Customer Support
Microsoft Community Forums
Sign in
Home
Library
Wiki
Learn
Gallery
Downloads
Support
Forums
Blogs
Resources For IT Professionals
United States (English)
Россия (Pусский)
中国(简体中文)
Brasil (Português)
Skip to locale bar
Post an article
Translate this page
Powered by
Microsoft® Translator
Wikis - Page Details
First published by
Adam Conkle - MSFT
(Microsoft)
When:
8 Apr 2011 10:30 AM
Last revision by
Fernando Lugão Veltem
(8MVP, Microsoft Partne)
When:
17 Jun 2012 2:57 PM
Revisions:
5
Comments:
1
Options
Subscribe to Article (RSS)
Share this
Can You Improve This Article?
Positively!
Click Sign In to add the tip, solution, correction or comment that will help other users.
Report inappropriate content using
these instructions
.
Wiki
>
TechNet Articles
>
AD FS 2.0: Event ID 47 is Logged in AD FS 2.0 Tracing/Debug with MSIS1022 and ID6008
AD FS 2.0: Event ID 47 is Logged in AD FS 2.0 Tracing/Debug with MSIS1022 and ID6008
Article
History
AD FS 2.0: Event ID 47 is Logged in AD FS 2.0 Tracing/Debug with MSIS1022 and ID6008
Table of Contents
Symptoms
Cause
Resolution
More Information
Symptoms
AD FS 2.0 is the Relying Party (RP)
An error occurs while consuming a security token from a trusted Claims Provider (CP)
The AD FS 2.0 Tracing/Debug log shows an event similar to the following:
Log Name:
AD FS 2.0 Tracing/Debug
Source: AD FS 2.0 Tracing
Date: 4/8/2011 8:48:24 AM
Event ID:
47
Task Category: None
Level: Error
Keywords: ADFSSamlProtocol
User: NETWORK SERVICE
Computer: <DNS-Name>
Description:
Microsoft.IdentityServer.Service.SamlProtocol.SamlProtocolException:
MSIS1022: Cannot process SAML Response from ''.
Inner exception: ID6008: Cannot resolve the '' URI in the signature to compute the digest.
at Microsoft.IdentityServer.Service.Tokens.SamlMessageSecurityTokenHandler.ReadToken(XmlReader reader)
at Microsoft.IdentityModel.Tokens.SecurityTokenHandlerCollection.ReadToken(XmlReader reader)
at Microsoft.IdentityModel.Tokens.SecurityTokenElement.ReadSecurityToken(XmlElement securityTokenXml, SecurityTokenHandlerCollection securityTokenHandlers)
at Microsoft.IdentityModel.Tokens.SecurityTokenElement.GetSecurityToken()
at Microsoft.IdentityModel.Tokens.SecurityTokenElement.CreateSubject(XmlElement securityTokenXml, SecurityTokenHandlerCollection securityTokenHandlers)
at Microsoft.IdentityModel.Tokens.SecurityTokenElement.GetSubject()
at Microsoft.IdentityServer.Service.SamlProtocol.SamlProtocolService.GetEffectivePrincipal(SecurityTokenElement securityTokenElement)
at Microsoft.IdentityServer.Service.SamlProtocol.SamlProtocolService.Issue(IssueRequest issueRequest)
at Microsoft.IdentityServer.Service.SamlProtocol.SamlProtocolService.ProcessRequest(Message requestMessage)
Cause
The Claims Provider is signing either the protocol message, the assertion, or
both, and they are not providing an appropriate Reference URI value within the
Signature section(s).
Resolution
The Claims Provider has the option of digitally signing the protocol message, the assertion, or both
The SAML Response is required to have an ID property
The SAML Assertion is required to have an ID property
If the SAML Response is signed, its Signature portion must have a Reference URI value which equals the SAML Response ID value
If the SAML Assertion is signed, its Signature portion must have a Reference URI value which equals the SAML Assertion ID value
The Claims Provider must make changes on their side in order to enable the Reference URI to be populated with an appropriate value
More Information
Snippet of appropriate signed SAML Response:
<Response
IssueInstant="2011-04-04T00:46:02Z" Version="2.0"
ID="_c7055387-af61-4fce-8b98-e2927324b306
"
xmlns="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
<saml:Issuer>https://www.contoso.com/IDP"</saml:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:
Reference URI="#_c7055387-af61-4fce-8b98-e2927324b306
">
<ds:Transforms>
....
Snippet of appropriate signed SAML Assertion:
<Assertion
ID="_a75adf55-01d7-40cc-929f-dbd8372ebdfc"
IssueInstant="2011-04-04T00:46:02Z" Version="2.0"
xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
<Issuer>https://www.contoso.com/IDP</Issuer>
<ds:Signature xmlns:ds="
http://www.w3.org/2000/09/xmldsig
#">
<ds:SignedInfo>
<ds:CanonicalizationMethod
Algorithm="
http://www.w3.org/2001/10/xml-exc-c14n#"/
>
<ds:SignatureMethod
Algorithm="
http://www.w3.org/2000/09/xmldsig#rsa-sha1"/
>
<ds:
Reference URI="#_a75adf55-01d7-40cc-929f-dbd8372ebdfc
">
....
AD FS
,
AD FS 2.0
,
AD FS v2
,
adfs
,
ADFS 2.0
,
ADFS v2
,
event 47
,
Event ID 47
,
ID6008
,
MSIS1022
,
troubleshooting
,
URI in the signature to compute the digest
[Edit tags]
Leave a Comment
Please add 8 and 8 and type the answer here:
Post
Wiki - Revision Comment List(Revision Comment)
Sort by:
Published Date
|
Most Recent
|
Most Useful
Comments
Fernando Lugão Veltem
17 Jun 2012 2:52 PM
Fernando Lugão Veltem edited Revision 1. Comment: added toc
Edit
Page 1 of 1 (1 items)
Wikis - Comment List
Sort by:
Published Date
|
Most Recent
|
Most Useful
Posting comments is temporarily disabled until 10:00am PST on Saturday, December 14th. Thank you for your patience.
Comments
Posted by
Fernando Lugão Veltem
on
17 Jun 2012 2:52 PM
Fernando Lugão Veltem edited Revision 1. Comment: added toc
Edit
Page 1 of 1 (1 items)