Office 365 ADFS Proxy Error Event ID 364

  • Article

 

Symptoms:

The environment contains two ADFS servers implemented in the internal network and two ADFS Proxy servers implemented in the DMZ network.

When testing ADFS functionality from the internal network where sts.domain.com points to the NLB of the ADFS servers in the internal network the user can access Office 365.

When testing ADFS from the Internet or from the DMZ the ADFS Proxy returned the following error:

--------------------------------------------------------------------------

Error:

There was a problem accessing the site. Try to browse to the site again.

If the problem persists, contact the administrator of this site and provide the reference number to identify the problem.

Reference number: 25b51e4b-a68d-47d6-8fc7-ee5a56337ed4

--------------------------------------------------------------------------

 

The following snapshot shows the error:

clip_image002

 

When checking the event viewer on the ADFS Proxy servers the error Event ID 346 were logged several times:

--------------------------------------------------------------------------

Event id 364

Encountered error during federation passive request.

Additional Data

Exception details:

System.ServiceModel.Security.MessageSecurityException: An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail. ---> System.ServiceModel.FaultException: An error occurred when verifying security for the message.

-----------------------------------------------------------------------

The following snapshot shows the error in the event viewer:

clip_image004

 

Reason:

ADFS Proxy configuration was fine as well as the certificate. However after troubleshooting the error the cause of it was due to time change.

The internal ADFS servers synchronizing the time with the Domain Controllers (DCs), and there were 20 minutes time difference between the ADFS proxy servers and the ADFS servers.

 

Solution:

Reset the time on the ADFS proxy servers to match the time on the ADFS servers.