Recently I came across into an issue related with ADFS2.0, SharePoint 2013 and Chrome. The problem was that I configured SharePoint to work with ADFS, it seems that all worked well, I tested the web application with IE and works well. But, for my surprise, when I tried to test the Web Application with Chrome it prompted the credentials several times until it shows the message of “Access Denied”
At the beggining I was stuck with the problem and also I was doubting from my initial configuration, so I tried again with IE in another web application and it worked well. First match ball saved.
So, again, I configured another time the web application to work with adfs, I tested again with IE and it worked, but when I tried with Chrome, the same behaviour as before.
So I started to dig about it, and I found 2 KB’s of Microsoft explaining the problem and possible solutions: https://support.microsoft.com/en-us/kb/2709891 and https://support.microsoft.com/en-us/kb/2461628
The first solution is to configure in each registry of the computer that experienced that problem with Chrome the following:
1. On the computer where the web browser is experiencing the issue, start Registry Editor (regedit), and locate the following subkey.
2. In the Lsa subkey, locate the SuppressExtendedProtection value. If the value does not exist, you must add it. To add the value, right-clickLsa, point to New, and then click DWORD (32-bit) Value. Type SuppressExtendedProtection, and then press ENTER.
3. Right-click SuppressExtendedProtection, click Modify, and enter 1 (REG_DWORD).
4. Click OK and close Registry Editor.
The second solution is not recommended by Microsoft, but it is still valid.
Execute the following command to disable Extended Protection TokenCheck (See notes for what this is at the bottom of this article)
- Set-ADFSProperties –ExtendedProtectionTokenCheck None
- Restart the Active Directory Federation Services service on each of the ADFS farm servers for the changes to take effect. You do not need to make any changes to the proxy servers.
ExtendedProtectionTokenCheck – Copied directly from technet – Specifies the level of extended protection for authentication supported by the federation server. Extended Protection for Authentication helps protect against man-in-the-middle (MITM) attacks, in which an attacker intercepts a client’s credentials and forwards them to a server. Protection against such attacks is made possible through a Channel Binding Token (CBT) which can be either required, allowed or not required by the server when establishing communications with clients. http://technet.microsoft.com/en-us/library/ee892317.aspx
The other option is in the ADFS server, change the following:
Open IIS Management and browse Down to the LS Site. Open Authentication and choose Windows Authentication. Then Advanced Settings in Your right sidebar:
Set Extended Protection to Off.
After I made one of these changes, I was able to login to the Web Application with Chrome
Hope it helps!