Symptoms

• Using SingleSignOnRoleProvider2 to resolve Group Organization Claim names fails. This is commonly seen while attempting to resolve group claim names in
  
  SharePoint People Picker.
• The AD FS 1.1 debug log shows the following:

2011-04-18T14:48:58 [INFO] Processing HTTP POST: https://adfs.contoso.com/adfs/fs/federationserverservice.asmx

2011-04-18T14:48:58 [VERBOSE] Received message that is not SignIn Request or Response.

2011-04-18T14:48:58 [VERBOSE] InternalGetTrustedRealmUri: email - Group Claim Name

2011-04-18T14:48:58 [ERROR] Rejecting name 'Group Claim Name' because it lacks prefix







Cause



The Federation Service is not configured to allow anonymous resolution of group claim names.





Resolution



AD FS 1.1 in Windows Server 2008 and Windows Server 2008 R2 adds a feature which allows an administrator to decide whether to allow anonymous access to resolve Organization Claim names of type Group. This is implemented in a checkbox on the Advanced tab of the Federation Service Properties dialog in the AD FS 1.1 MMC console. If you wish to allow the anonymous access to resolve group claim names, you must check this checkbox.



When SharePoint People Picker invokes SingleSignOnRoleProvider2 to resolve the name, this call to the FederationServerService.asmx is performed anonymously, and it is a requirement that the checkbox is checked on the Federation Service in order to allow the People Picker to function as expected.





More Information



AD FS 1.0 on Windows Server 2003 R2 allows anonymous access to resolve Organization Claim names of type Group by default, thus the checkbox described above does not exist in AD FS 1.0.