search

Azure-Samples / active-directory-b2c-advanced-policies

Sample for use with Azure AD B2C with Custom Policies.
http://aka.ms/aadb2ccustom
MIT License
218 stars 143 forks source link

SAML2 custom policies: The SAML initiating message with id '' cannot be found in state #38

Open davidlevy-ecommbi opened 5 years ago

davidlevy-ecommbi commented 5 years ago

I have carefully followed the steps in these 2 tutorials to configure custom policies for SSO using SAML2, connecting AD B2C with a Java WebApp:

  1. https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-get-started-custom
  2. https://github.com/Azure-Samples/active-directory-b2c-advanced-policies/blob/master/Walkthroughs/RP-SAML.md

When logging in, my Web App (SP) builds the SAMLRequest and posts it to https://login.microsoftonline.com/te/TENANTID.onmicrosoft.com/B2C_1A_SignInSaml/samlp/sso/login. After that, I'm automatically redirected to the following URL:

https://login.microsoftonline.com/te/MYTENANTID.onmicrosoft.com/B2C_1A_SignInSaml/samlp/sso/assertionconsumer

And the following error is displayed:

Sorry, but we're having trouble signing you in.We track these errors automatically, but if the problem persists feel free to contact us. In the meantime, please try again. Correlation ID: 5bc89c54-bd95-4a4a-8072-fc4f5721c8d2 Timestamp: 2018-10-02 03:08:30Z AADB2C90165: The SAML initiating message with id '' cannot be found in state.

Already googled the issue and asked to Microsoft's support, but no answer found in either of them. Since Identity Framework is in Preview, there's no official support for these features.

Attached my custom policies

customPolicies.zip

.

fujie commented 5 years ago

Do you mean your java web app(SP) redirect user to 'https://login.microsoftonline.com/te/MYTENANTID.onmicrosoft.com/B2C_1A_SignInSaml/samlp/sso/assertionconsumer' ? If so, check your web app configuration. The web app(SP) should be configured to redirect to SSO Service Url with authentication request and Azure AD B2C's SSO Service Url is this: https://login.microsoftonline.com/te/TENANTID.onmicrosoft.com/B2C_1A_SignInSaml/samlp/sso/login

davidlevy-ecommbi commented 5 years ago

Do you mean your java web app(SP) redirect user to 'https://login.microsoftonline.com/te/MYTENANTID.onmicrosoft.com/B2C_1A_SignInSaml/samlp/sso/assertionconsumer' ? If so, check your web app configuration. The web app(SP) should be configured to redirect to SSO Service Url with authentication request and Azure AD B2C's SSO Service Url is this: https://login.microsoftonline.com/te/TENANTID.onmicrosoft.com/B2C_1A_SignInSaml/samlp/sso/login

The /login page is hit first with the SAMLRequest param. After that, I'm redirected to /assertionconsumer and see the error. Will update the issue description with this to avoid confusion. The web app sso login url is configured properly. The issue is something else