定制STS和Azure ACS 错误 ACS50008：SAML 令牌无效
我有一个自定义的 STS 实现。目前，它被配置为 Azure ACS 上的附加身份提供程序。我有一个依赖方网站，该网站已通过 ACS（Windows Live、Google 等）成功进行身份验证。但是，每当我尝试使用自定义 STS 登录时，我总是收到错误 401。
- 错误代码 ACS20001：处理 WS-Federation 登录响应时发生错误。
- 错误代码 ACS50008： SAML 令牌无效。
我已在论坛中进行了搜索，但就我而言，我没有获得有关该错误的更多详细信息，并且不知道如何继续并修复此问题。
我的 STS 目前处于测试阶段，可以在此处访问： 元数据 。
如果有人有任何建议或想尝试一下，请通过电子邮件与我联系，我将在我的自定义提供商上打开演示登录。
注意：该案例与发现的类似问题不同此处，因为我的内部异常详细信息没有表明任何原因。
更新：查看此thread 了解一些附加信息以及我从 fiddler 中提取的有效负载。
预先感谢，
康斯坦丁诺斯
I have a custom STS implementation. Currently it is configured as an additional identity provider on Azure ACS. I have a relying party website that is authenticating successfully via ACS (Windows Live, Google, etc). However, whenever I try to login using my custom STS I always get the Error 401.
- Error Code ACS20001: An error occurred while processing a WS-Federation sign-in response.
- Error Code ACS50008: SAML token is invalid.
I have searched through the forums but in my case I dont get any more detail on the error and do not know how to proceed and fix this.
My STS is currently on beta and can be reached here: metadata .
If anyone has any suggestions or wants to give it a try please contact me via email and I will open a demo login on my custom provider.
note: The case is different than similar question found here since my inner exception details do not suggest any reason.
UPDATE: check the discussion in this thread for some additional informaton and the payloads I extracted from fiddler.
Thanks in advance,
Constantinos
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我终于在Azure上的微软支持的帮助下解决了这个问题。
似乎“ACS50008：SAML 令牌无效”错误非常普遍，通常内部异常中包含更多信息，但不会出现在错误屏幕上。为什么会发生这种情况对我来说仍然是个谜。
因此，对于任何碰巧处于我的位置的人，我指出了发生这种情况的两个可能原因。
就我而言，主体名称末尾不应包含正斜杠。我们将其从 https://login.mydomain.com/ 更改为 https://login.mydomain.com 错误消失了！
I finally figured this out with the help of ms support on Azure.
It seems that the "ACS50008: SAML token is invalid" error is quite generic and usually there is more information in an inner exception that does not end up on the error screen. Why this happens is still a mystery for me.
So for anyone that happens to be in my position I nailed two possible reasons for this to happen.
<saml:Conditions NotBefore="...." NotOnOrAfter="....">
If that's the case you may try to set lifetime to (now - a buffer time such as 5 mins) to now + 1 hour.In my case the principal name should not contain the forward slash at the end. We changed it from https://login.mydomain.com/ to https://login.mydomain.com and the error went away!
您始终可以向 Microsoft 创建支持案例并让他们帮助解决问题：
https://support.microsoft.com/oas/default.aspx?&c1=501&gprid=14928&&st=1&wfxredirect=1&sd=gn
You can always create a support case with Microsoft and have them help figure it out:
https://support.microsoft.com/oas/default.aspx?&c1=501&gprid=14928&&st=1&wfxredirect=1&sd=gn