SimpleSAML Unable to validate Signature error - azure

Today, June 23rd, 2022, we are experiencing a mysterious phenomenon that I simply can not see myself out of.
We are a software company where our customers use Azure AD as a login method using SimpleSAML.
This means that these are different websites with different associated Azure ADs.
Today, we have seen that 7 different sites, incl. one of our own, experienced to get the error:
SimpleSAML\Error\Error: UNHANDLEDEXCEPTION
Caused by: Exception: Unable to validate Signature
The above is solved with a refresh of the metadata, and the pages are live again without any problems.
No certificates are due to expire, and the earliest will not expire until 2023.
I can not find any global issue with Microsoft or Azure, and our setup has been working fine for so long, and with the refresh of metadata, it's working again.
Does anyone have any clue on, what could be the issue? It just seems strange that there are 7 different websites, with different Azure setups and different metadata who experience this kind of issue on the same day, within 8 hours of each other.
Beware that we are running a daily cronjob to ensure metadata is refreshed.
Image of the error from 1 of the sites

Microsoft products automatically perform rollover for their certificates. So it can be that the parties you interfaces with automatically rolled over to new certificates. Refreshing the metadata explains why that solved the problem.
ADFS/AD will have the old and new certificate both in metadata for a while before the old one is invalidated, so periodic refresh should work to keep the service working without downtime.

Related

Azure AD users are no longer deactivated when removed from assigned users

We created an application with SCIM support over two year ago now and it always worked fine. However recently we have been getting reports from customers that users were no longer deleted/disabled from the target enterprise application.
I already saw there was another question like this one a few years back but that seems resolved and this seems like another issue.
We did a little research on our own and noticed that azure is not sending any requests at all when we remove a user from the assigned user list. We checked the incoming logs from our application and IIS logging and both do not show any requests are sent our way. (we do get logs from POST/GET/PUT of other provisioning related tasks, like creating a user).
In azure audit logs we do see the following:
Remove app role assignment from user
Add a deletion-marked app role assignment grant to user as part of link removal
Which seems to me that azure is doing something, it's just not sending it to the targeted application
Current situation:
We have user A that was created in azure ad and is assigned to our application. Provisioning configuration was done by means of SCIM in azure. And the user is also created in our application, so the connection seems fine.
When I remove the user from the assigned user list in our enterprise application, I expected that counts as a softdelete, causing Azure to sent a PATCH or a PUT to set the active property of the user to false. In case I would delete them entirely from AD I expected them to be removed with the DELETE. I read that it takes up to 30 days which is no problem, but the problem is that user that are no longer assigned are still active in the target application, which is no good.
I have some basic properties mapped on the user and the one thing that might be involved with this issue would be the Not([IsSoftDeleted]) mapping which is mapped to our active property. I don't see how that is wrong, but that's all I can think of at this point.
Anyone that can has any idea what is going here?
Thanks!
I have had contact with Microsoft regarding this issue and it seems to be a bug on their end which they are currently correcting. It is part of a larger set of bugfixes all regarding similar issues so they could not give me a specific time when this specific issue was resolved, but they think around the 10th of July (2020).
In any case, as this was a bug due to changes pushed by MS this is no longer an issue to be solved.
Update:
I have received some replies that a few bugs were fixed connected to this issue but not all. I'm currently on vacation so i'm not sure if the main issue is fixed as well. They did promise a fix fast though.
For now all I can give you is a workaround. The issue happens when the only change that is happening is the unassignment of users, it simple won't execute this until at least 1 property from an assigned user is also changed. When anything is changed, it will fix all unassignments and disable them all, even if the unassignment was in a different sync cycle. So until the actual fix is pushed, that might be helpful to know.
I will keep this thread updated if I get more information.
Ps: The Azure team requested that if anyone else also ran into this issue they report it through Azure. Their dev team will see if your problem matches up with my issue or if it's something new. So please do that as well.

Getting a AADSTS700016 error during Microsoft WSFed application sign in

I'm trying to use Azure AD as a standin for production level ADFS systems during development of an application. Up until today, everything worked fine. I don't know what I touched to break everything, but now I'm getting the following error:
AADSTS700016: Application with identifier 'https://foo.bar.localhost:44300/' was not found in the directory '[[GUID]]'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.
I don't know what's changed, or why this worked last week and not today. I've been trying to change any number of settings - even deleted the app and re-created it, and nothing seems to help. Most of the other articles online keep referring to old versions of the Azure portal, so the clicks/links/menus that they are referring to no longer apply. There's a little popup on my sign in screen that says that I can enable "Advanced Diagnostics", but I don't know where those results show up so that I can see it.
Some things that I've checked:
- Under "App Registrations", the Endpoints for "Federation metadata document" and "WS-Federation sign-on endpoint" match what my application is using (so I'm going to the right place).
- When I click my application, under "Authentication", the Redirect URIs contains "https://foo.bar.localhost:44300/". I've tried with or without the trailing slash (and, sometimes, both).
Those are the biggest two places that other articles imply there may be an issue. Does anyone have any other ideas? Are there specific user-level things that I should be doing? Has something changed (very recently) that would be affecting my ability to use this feature? How are Enterprise Applications related (they're a Premium feature, and my Subscription is not)? I need to get my log-ins working again so that I can get my development process back underway. Thanks!!
Finally found the right setting. Turns out, many of my old applications were created when I was a "personal" user. I've since become a domain/work user, and it puts some things in place differently than before. In this case, I had to change the Application ID URI listed under "Expose an API" for my application. Setting this (where it wasn't set to anything before) allowed my application to be found and my login to succeed.

Windows 10 App : update taking long time

I have submitted a second update of my application and its been two day, my app is in certification.where as, my first submission was passed within 2 hours.
App updates: resolved minor bugs and added a privacy policy criteria for ads. I have added ads in this update as well. I used myapppolicy.com site for making my privacy policy and added a link in the description while submitting.
I just submitted an app update on Saturday, but it wasn't until Monday that it was published - previously it took only a few hours. So, don't worry - it looks like app certification might have slowed down for some reason. If there's a problem with your submission, Microsoft will tell you.

Azure - Creation of web site 'null' failed

I finally decided to give Azure a try and the first thing I do - creating a simple web site - fails with: Creation of web site 'null' failed. Details say: Provisioning failed.
I am simply trying to "quick create" a simple website. Researching the Web, I see other people with the same problem, but no real solution.
I do have an active "Visual Studio Ultimate with MSDN" subscription and $150 of unexpired credits.
I must be missing something very fundamental.
Seems to be known issue:
A number of users have experienced “Provisioning Failed” errors when
attempting to deploy Windows Azure Websites. This is a known issue
with the trial version, and there is an active discussion thread on
the MSDN forums here.
It is expected that this is a temporary problem that will be fixed
soon, in the meantime there are a few things you can try: Ensure
database passwords do not contain special characters like ', ", =,
etc. Try creating a website without a database, database creation may
be causing the error. Try deploying the site in a few hours, it may be
a temporary problem in the data center.
So, to put some closure on this, I contacted Microsoft Support and they suggested trying to login to the portal through an anomymous/incognito browser session. Once I did that, I was able to create a website.
Mind you, having cleared all persistent data (cookies, etc.) in the regular browser, I still cannot do anything in Azure, from several different machines. But at least the incognito session is a workable workaround.

Intermittent Issues with Excel Services web parts

We have a brand new SharePoint 2007 Intranet farm running on new 64-bit hardware with lots of processor and memory. We are using Kerberos for security and have carefully followed all the written guidance from Microsoft and blogs to configuring Kerberos and Excel Services correctly. Generally everything is running great.
Currently we can add Excel Web Access web parts on SharePoint team site pages and connect them up to SQL 2005 Analysis Cubes for use with doing Pivot Tables, Graphs, etc... As part of this, we have created a test dashboard page that has six of these web parts that display upon page load. However we have noticed that we get intermittent errors when a user does things like refresh the connection or workbook, or change the filter on PivotTables. The user gets a generic error messages such as "An error has occurred. Please contact an administrator." and then their session in Excel Services is hosed up. They have to shut down IE and come back to the site in order to interact successfully with the Excel web parts again.
I have looked at the logs but just see generic messages like "EcsSoapException: An error has occurred." that don't give me something that I can really act on. Also I have checked the application event logs but didn't find anything relevant.
Any ideas on how to troubleshoot this?
It turns out this is a bug with Kerberos in Windows 2008. Microsoft has just released a hotfix for this (see link below). The hotfix completely resolved all my issues.
http://support.microsoft.com/kb/969083

Resources