SharePoint FedAuth Cookies and Office Client Integration Behavior

Agent for SharePoint Release Notes › Known Issues › SharePoint FedAuth Cookies and Office Client Integration Behavior

SharePoint FedAuth Cookies and Office Client Integration Behavior

Symptom:

SharePoint stores a persistent FedAuth cookie on the hard drives of authenticated users. I do not want the SharePoint server to use these persistent cookies.

Solution:

You can configure SharePoint so a persistent FedAuth cookie is not stored. However, disabling the persistent FedAuth cookie also disables the single-sign on function of Office Client Integration. Users who try to open files on the SharePoint server are challenged for their credentials.

Note: For more information about how to disable FedAuth cookies in SharePoint 2010, go to the technet blogs website, and then search for the following phrase:

"Setting the Login Token Expiration Correctly for SharePoint 2010 SAML Claims Users"

Duplicate Ports not Detected by Configuration Wizard

Symptom:

I received an error message regarding a duplicate port after running the Configuration Wizard for the Agent for SharePoint.

Solution:

Do the following:

To change an HTTP port, do the following steps:
1. Open the following file:
```
Agent-for-SharePoint_home\httpd\conf\httpd.conf
```
2. Locate the following directive:
```
Listen port
```
3. Change the port number to the one you want to use for HTTP.
4. Locate the following directive:
```
ServerName url:port
```
5. Change the port number at the end of the URL to the same one you changed in Step c.
6. Save your changes to the file.
To change an HTTPS port, do the following steps:
1. Open the following file:
```
Agent-for-SharePoint_home\httpd\conf\extra\httpd-ssl.conf
```
2. Locate the following directive:
```
Listen port
```
3. Change the port number to the one you want to use for HTTPS.
4. Locate the following directive:
```
ServerName url:port
```
5. Change the port number at the end of the URL to the same one you changed in Step c.
6. Locate the following directive:
```
<VirtualHost url:port>
```
7. Change the port number at the end of the URL to the same one you changed in Step c.
8. Save your changes to the file.
Restart the CA SiteMinder® Agent for SharePoint.

Close Browser After Logging Off with X.509 Authentication Scheme (CQ 134124)

Symptom:

I can access a protected SharePoint resource with the SiteMinder X.509 authentication scheme after logging out by clicking the back button in the browser. If I click the Sign In as different user button on a SharePoint site protected with the CA SiteMinder® X.509 Authentication scheme, the home page appears.

Solution:

This behavior is a known issue. The problem occurs when the client certificate remains in the browser cache. Close the browser after logging out.

Inconsistency between runtime Access Policy and People Picker Behavior (CQ 134290)

An inconsistency occurs between an access policy and the people picker when CA SiteMinder® Forms protection is configured for a SharePoint web application or zone.

User access to a SharePoint site is governed first by the CA SiteMinder® user policy and then by the SharePoint permissions.

The behavior changes when SharePoint permissions are configured through the People and Groups dialog (people picker) and the CA SiteMinder® protection is configured using ASP.NET Forms authentication. The CA SiteMinder® user directory connection object governs the list of users and groups returned. The CA SiteMinder® user access policy does not affect the results.

This behavior means that while a SharePoint site administrator can select users using People and Groups dialog (people picker) and grant them access to a SharePoint resource, CA SiteMinder® denies them access to the resource at runtime.

As a workaround, do the following steps:

Create CA SiteMinder® user directory connection objects that are restricted to the set of users contained in the CA SiteMinder® user policy associated with the SharePoint sites.
Include the directory object in the policy and select all users from this directory object in the user policy.

Cannot Access Protected SharePoint Resource using the Impersonation Authentication Scheme (CQ 135275)

Symptom:

I cannot access a protected SharePoint web application using the CA SiteMinder® Impersonation Authentication scheme, and a page cannot be displayed error appears.

Solution:

The CA SiteMinder® Agent for SharePoint does not currently support the Impersonation Authentication scheme.

Cannot Access Protected SharePoint Resource using the Anonymous Authentication Scheme (CQ 135276)

Symptom:

I cannot access a protected SharePoint web application using the CA SiteMinder® Anonymous Authentication scheme, and a page cannot be displayed error appears.

Solution:

This error message appears because the SMIDENTITY cookie is created with the anonymous login instead of the SMSESSION cookie. The CA SiteMinder® Agent for SharePoint does not currently support the Anonymous Authentication scheme.

Traditional Web Agents As Cookie Providers not Supported (CQ137292)

Symptom:

If I set up a traditional web agent as a cookie provider, the traditional web agent does not operate well with the CA SiteMinder® Agent for SharePoint.

Solution:

This scenario is not supported. Use a framework-based web agent as a cookie provider in this situation.

Incorrect SAML 2.0 Auto-post Message Appears During Log On (CQ 137350)

Symptom:

I see a SAML 2.0 Auto-post on the browser tab while logging on to the CA SiteMinder® Agent for SharePoint.

Solution:

This behavior is a known issue. SiteMinder CA SiteMinder® Agent for SharePoint does not consume SAML 2.0 but uses WS-Federation 1.1 Token protocol. The message which appears in the tab is defined in the FWS constants class as SAML2_AUTO_POST_FORM_TITLE. This class is the base class for all federation protocols.

HTTP 500 Error is Displayed when SharePoint Issues a 302 as FedAuth Cookie Expires (CQ 138199)

Symptom:

The SharePoint redirect fails and a 500 error appears in my browser when the following occurs:

I perform a POST action on a page in SharePoint, and the SharePoint Fed-Auth cookie expires.

Solution:

This behavior is a known issue with the SharePoint Claims-based authentication model. SharePoint Claims Authentication fires a 302 redirect to the account partner to re issue a WS-FED Token instead of allowing SharePoint to acknowledge the POST. Using the WS-FED Token SharePoint re-creates a new Fed-Auth Cookie. SharePoint then tries to redo the same POST action and the HTTP 500 error is displayed.

Search for Claims works with IdentifierClaim at certain places in SharePoint

Symptom:

When multiple claims are configured for a Trusted Identity Provider, I can search for claims at certain key areas in SharePoint only with the claim that is designated as the IdentifierClaim.

Solution:

This behavior is a known limitation with SharePoint. At certain areas, search works only with the IdentifierClaims and not the other claims. Some of the areas where configured claims cannot be searched include the following:

Site Collection Administration
People Picker Window
Check Permission in the People Picker Window

ProxyTrust agent configuration parameter not necessary (CQ 138235)

Symptom:

In the previous SiteMinder Agent for SharePoint version, I had to set the ProxyTrust parameter when the agent operated behind a proxy server. How do I set it for this release?

Solution:

This version of the Agent for SharePoint is implemented as part of a proxy-based authentication solution. Setting the ProxyTrust parameter in your agent configuration is no longer necessary.

Default Location of FCC forms in Administrative UI does not Work

Symptom:

I tried to configure CA SiteMinder® forms-based authentication (FCC), but when I use the following default value shown in the Administrative UI, it does not work:

/siteminderagent/forms/login.fcc

Solution:

The Agent for SharePoint uses a different directory for forms-based authentication. Do the following:

Create the siteminderagent directory in the following location:
Agent-for-SharePoint_home/proxy-engine/examples/siteminderagent
Copy the forms folder from the following directory:
Agent-for-SharePoint_home/proxy-engine/examples

To the following directory:

Agent-for-SharePoint_home/proxy-engine/examples/siteminderagent

The forms are copied to Agent-for-SharePoint_home/proxy-engine/examples/siteminderagent/forms.

SharePoint Component in Profiler is for SharePoint 2007 Agent (CQ 139389)

Symptom:

The Policy Server Profiler contains a SharePoint component which is included in the trace file.

Solution:

The SharePoint component in the Profiler is for the CA SiteMinder® Agent for SharePoint 2007 solution. Because the CA SiteMinder® Agent for SharePoint 2010 solution is based on SAML federation, this component does not function as designed.

To trace internal Policy Server diagnostics and the communication with the CA SiteMinder® Agent for SharePoint, use the profiler settings based on SAML IDP profiler trace template (samlidp_trace.template).

Incorrect Trace.conf Path in LoggerConfig.properties File (CQ 142005)

Symptom:

The LoggerConfig.properties file shows the Trace.conf configuration file location as TraceConfig=/CA/Agent-for-SharePoint/conf/defaultagent/FederationTrace.conf

Solution:

The location of the Trace.conf file is incorrect in the LoggerConfig.properties file. The proxy-engine subdirectory is missing. Set the correct path to /CA/Agent-for-SharePoint/proxy-engine/conf/defaultagent/FederationTrace.conf.

SharePoint People Picker Stops Responding (CQ139284)

Symptom:

The SharePoint people picker stops responding during searches.

Solution:

This behavior is normal. This condition occurs when the FedAuth cookie expires.

As a workaround, close the SharePoint people picker. Wait a moment and open the SharePoint people picker again.

Backup your Existing Proxy Rules before Running Configuration Wizard (CQ142050, CQ140787)

Symptom:

I want to run the configuration wizard for the CA SiteMinder® Agent for SharePoint again. What happens to my configuration settings?

Solution:

Back up your existing proxy rules file in the following location before running the configuration wizard again:

Agent-for-SharePoint_home\proxy-engine\conf\proxyrules.xml

After you run the wizard, delete the new proxyrules.xml file and rename your backup copy accordingly.

No Assertion Consumer URL found for RP Message in Log Files (CQ141783)

Symptom:

The following message appears in my federationtrace.log file:

No Assertion Consumer URL found for RP

What does it mean?

Solution:

This message is informational only. No problem exists.