ADFS 2.0: Chrome users repeteadly prompted for credentials

Hi all!

Recently I came across into an issue related with ADFS2.0, SharePoint 2013 and Chrome. The problem was that I configured SharePoint to work with ADFS, it seems that all worked well, I tested the web application with IE and works well. But, for my surprise, when I tried to test the Web Application with Chrome it prompted the credentials several times until it shows the message of “Access Denied”

At the beggining I was stuck with the problem and also I was doubting from my initial configuration, so I tried again with IE in another web application and it worked well. First match ball saved.

So, again, I configured another time the web application to work with adfs, I tested again with IE and it worked, but when I tried with Chrome, the same behaviour as before.

So I started to dig about it, and I found 2 KB’s of Microsoft explaining the problem and possible solutions: https://support.microsoft.com/en-us/kb/2709891 and https://support.microsoft.com/en-us/kb/2461628

The first solution is to configure in each registry of the computer that experienced that problem with Chrome the following:

1. On the computer where the web browser is experiencing the issue, start Registry Editor (regedit), and locate the following subkey.
HKEY_LOCAL_MACHINESystemCurrentControlSetControlLsa

2. In the Lsa subkey, locate the SuppressExtendedProtection value. If the value does not exist, you must add it. To add the value, right-clickLsa, point to New, and then click DWORD (32-bit) Value. Type SuppressExtendedProtection, and then press ENTER.

3. Right-click SuppressExtendedProtection, click Modify, and enter 1 (REG_DWORD).

4. Click OK and close Registry Editor.

The second solution is not recommended by Microsoft, but it is still valid.

Execute the following command to disable Extended Protection TokenCheck (See notes for what this is at the bottom of this article)

  1. Set-ADFSProperties –ExtendedProtectionTokenCheck None
  2. Restart the Active Directory Federation Services service on each of the ADFS farm servers for the changes to take effect.  You do not need to make any changes to the proxy servers.

Notes
ExtendedProtectionTokenCheck – Copied directly from technet – Specifies the level of extended protection for authentication supported by the federation server. Extended Protection for Authentication helps protect against man-in-the-middle (MITM) attacks, in which an attacker intercepts a client’s credentials and forwards them to a server. Protection against such attacks is made possible through a Channel Binding Token (CBT) which can be either required, allowed or not required by the server when establishing communications with clients.  http://technet.microsoft.com/en-us/library/ee892317.aspx

The other option is in the ADFS server, change the following:

Open IIS Management and browse Down to the LS Site. Open Authentication and choose Windows Authentication. Then Advanced Settings in Your right sidebar:

adfsiis2

Set Extended Protection to Off.

After I made one of these changes, I was able to login to the Web Application with Chrome

Hope it helps!

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s