Outlook加载身份验证失败反对ADFS服务器

展望2016
的Windows Server 2016
微软的Visual Studio社区2017年

问题描述：

我正在开发一个应用于ADFS服务器进行身份验证的Outlook加载项。

在认真执行此处列出的步骤： https://tech.greenhouse.io/2016/08/01/create-adfs-instance-on-azure-virtual-machine.html

我能够通过ADFS在Internet Explorer和Chrome浏览器成功登录外部的ADFS用户。

试图用同样的方式通过Outlook来登录插件我得到，说下面的页面然而，当：

 
ADFS Login 
An error occurred 
An error occurred. Contact your administrator for more information. 
Error details 
© 2016 Microsoft

下面是样品日志文件。

Outlook插件：

 
Add-in successfully started up. 
User interaction in Outlook ribbon happened. 
SAML SP login: https://validsslcertdomain.com/saml2/login/?idp=http://adfsserverinazurecloud.com/adfs/services/trust 
SAML IDP Url: https://adfsserverinazurecloud.com/adfs/ls/?SAMLRequest=jZJNTxsxEIbv/RWWLzntejcSKrWyiwJR1AhKo2RBKrfBOymWvPbWYxPCr8ebpBQuUa8z7/vM5+TipTPsGT1pZ6tRmRcjhla5Vtvf1eiumWfno4v6y4SgM72cxvBkV/gnIgWWjJbkkKh49FY6IE3SQockg5Lr6Y8bOc4LCUToQ8LzD5b+tKf3LjjlDGfTv+4rZyl26Nfon7XCu9VNxZ9C6EkKETFrqSizAJAHHcButMFcuU4MtcYCFAnOZqlrbWGA/bO+y6HdUI5AIVKujIst9H0Or9EfQENamAGzmFVct9lr2M7nv+J18RDV9a5vtilDFHFhKRFDxcdF+TUri6w8b8pSFmfy7NsDZ8vjZJfa7nd8cg2PBxHJ702zzJY/1w1n98db8STg9f4wcl/Ys7nzHYTTyCGSut/spRJtmn/H6/9dZIcBWgggJuJD4fr4HreJvZgtndFqx6bGuO2VRwhY8Q0YQv7eIGeiPhA+/1T9Bg==&RelayState=/ 
SAML WIA Url: https://adfsserverinazurecloud.com/adfs/ls/wia?SAMLRequest=jZJNTxsxEIbv/RWWLzntejcSKrWyiwJR1AhKo2RBKrfBOymWvPbWYxPCr8ebpBQuUa8z7/vM5+TipTPsGT1pZ6tRmRcjhla5Vtvf1eiumWfno4v6y4SgM72cxvBkV/gnIgWWjJbkkKh49FY6IE3SQockg5Lr6Y8bOc4LCUToQ8LzD5b+tKf3LjjlDGfTv+4rZyl26Nfon7XCu9VNxZ9C6EkKETFrqSizAJAHHcButMFcuU4MtcYCFAnOZqlrbWGA/bO+y6HdUI5AIVKujIst9H0Or9EfQENamAGzmFVct9lr2M7nv+J18RDV9a5vtilDFHFhKRFDxcdF+TUri6w8b8pSFmfy7NsDZ8vjZJfa7nd8cg2PBxHJ702zzJY/1w1n98db8STg9f4wcl/Ys7nzHYTTyCGSut/spRJtmn/H6/9dZIcBWgggJuJD4fr4HreJvZgtndFqx6bGuO2VRwhY8Q0YQv7eIGeiPhA+/1T9Bg==&RelayState=/&client-request-id=a1209b03-ffed-419c-4904-0080000000f4

ADFS服务器：

错误ID：364

Encountered error during federation passive request. 

Additional Data 

Protocol Name: 

Relying Party: 

Exception details: 
System.FormatException: Invalid length for a Base-64 char array or string. 
    at System.Convert.FromBase64_Decode(Char* startInputPtr, Int32 inputLength, Byte* startDestPtr, Int32 destLength) 
    at System.Convert.FromBase64CharPtr(Char* inputPtr, Int32 inputLength) 
    at System.Convert.FromBase64String(String s) 
    at Microsoft.IdentityServer.Protocols.Saml.HttpSamlBindingSerializer.DecodeMessageInternal(String message) 
    at Microsoft.IdentityServer.Protocols.Saml.HttpSamlBindingSerializer.ReadProtocolMessage(String encodedSamlMessage) 
    at Microsoft.IdentityServer.Protocols.Saml.HttpSamlBindingSerializer.CreateFromNameValueCollection(Uri baseUrl, NameValueCollection collection) 
    at Microsoft.IdentityServer.Protocols.Saml.HttpRedirectSamlBindingSerializer.ReadMessage(Uri requestUrl, NameValueCollection form) 
    at Microsoft.IdentityServer.Web.Protocols.Saml.HttpSamlMessageFactory.CreateMessage(WrappedHttpListenerRequest httpRequest) 
    at Microsoft.IdentityServer.Web.Protocols.Saml.SamlContextFactory.CreateProtocolContextFromRequest(WrappedHttpListenerRequest request, ProtocolContext& protocolContext) 
    at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.CreateProtocolContext(WrappedHttpListenerRequest request) 
    at Microsoft.IdentityServer.Web.PassiveProtocolListener.GetProtocolHandler(WrappedHttpListenerRequest request, ProtocolContext& protocolContext, PassiveProtocolHandler& protocolHandler) 
    at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)

这里是关于外接示例代码：

// String definitions 
string samlAcs = Properties.Settings.Default.samlAcs; 
string samlIdp = Properties.Settings.Default.samlIdp; 
string serverUrl = Properties.Settings.Default.serverUrl; 
string loginUrl = serverUrl + "/saml2/login/?idp=" + samlIdp; 
var acsUrl = serverUrl + samlAcs; 
string wiaHtmlBody = ""; 
HttpResponseMessage response; 

try 
{ 
    response = await client.GetAsync(loginUrl); 
... 
try 
{ 
    response = await client.GetAsync(response.Headers.Location); 
... 
var wiaUrl = response.Headers.Location.ToString(); 
if (wiaUrl[0] == '/') wiaUrl = serverUrl + wiaUrl; 
try 
{ 
    response = await client.GetAsync(wiaUrl); 
    response.EnsureSuccessStatusCode(); 
    wiaHtmlBody = await response.Content.ReadAsStringAsync(); 
... 
var wiaDoc = new XmlDocument(); 
try 
{ 
    wiaDoc.Load(new StringReader(wiaHtmlBody)); 
    var samlNode = wiaDoc.DocumentElement.SelectSingleNode("//input[@name='SAMLResponse']"); 
    string samlResponse = samlNode.Attributes["value"].Value; 
...

时，预计来自服务器的XML文件，它抛出该异常：

 
Exception: System.NullReferenceException: Object reference not set to an instance of an object.

类似的问题： https://serverfault.com/questions/753149/ad-fs-3-0-event-id-364-while-creating-mfa-and-sso

问题： 我会采取什么步骤来解决这个问题？

在此先感谢。

来源

2017-10-18 Max Revine

看来wiaUrl不是URL编码的，因为您在从response.Headers.Location中检索它时将其转换为字符串。这将解释为什么base-64解码器失败，因为ADFS首先尝试对SAML请求消息进行URL解码。

换句话说，您必须将URL编码字符串传递给client.GetAsync(wiaUrl)或URI对象。

来源

2017-10-18 23:22:30

Outlook加载身份验证失败反对ADFS服务器

回答

相关问题