Geek Answers Handbook

Azure ACS with WAAD as IdP gives WS-Federation protocol error if it is already subscribed to another Microsoft account

My third-party application uses Windows Azure ACS to authenticate users. I have ACS configured to use Windows Azure Active Directory (WAAD) as an identity provider. This works for the most part, and users can log into my application using the identifiers I provided for them in WAAD. However, the problem is that if a user signs up for another Microsoft account and tries to log into my application in the same browser instance, he gets an ugly ACS error "ACS20012: request is not a valid WS-Federation protocol message." For example, if I open Chrome and subscribe to the Windows Azure management portal using my Windows Live ID, and then open a new tab and try to log into my user application, I will get this error. If I open a new browser or clear my cookies, I can simply sign up.

Can't I log in to both apps in the same browser instance?

+4
source share
1 answer

Nope.

This is a requirement to ask to subscribe to two Google accounts (or two Live IDs or any other accounts) in one browser instance (which may actually be possible using Chrome , but there is NO general case). It is simply not possible today.

However, it is ugly to see this error message on the ACS website. Have you configured the ERROR URL for your relying party in ACS? Although this property is optional, I strongly recommend that customers use it and handle requests correctly. I have not tried your specific scenario, but I believe that ACS will redirect the user to the error URL after configuring it, so you at least know what is going on.

Please configure the error URL for your relying party and let us know if the user will be redirected to your site. Then you can create the correct error message.

UPDATE

If you say that this only happens when you log in to the Azure Management Portal, then this (my spec!) Is almost the same as logging in with WAAD. There have been some changes with GA WAAD. If you follow the actual login flow using Fiddler, you will notice that when the login to the management portal has a slightly different flow, then, for example, logging into Hotmail. If you log in to Hotmail, you simply redirect to login.live.com , you log in and return to Hotmail.

Now, if you check the traffic when navigating through manage.windowsazure.com , you will notice that there is a first redirect to login.microsoftonline.com (this is WAAD being processed!). It then redirects to login.live.com (this is for your Live ID account). My guess is that WAAD from login.microsoftonline.com combines the Live ID ( login.live.com ) for authentication. This is why you are really logged in with WAAD and why your application is not working.

Please do the following experiment to make sure that I am wrong or not:

  • Delete all browser cookies.
  • Go to Hotmail and log in to your Live ID account.
  • Now open a new tab and open your own application that integrates WAAD through ACS

I suspect you can now log in to your application.

+4
source

More articles:


All Articles