Partager via

Event ID 666 — Federation Service Proxy Communication

  • Article

Applies To: Windows Server 2008

Successful communication between federation servers and federation server proxies can depend largely on whether client authentication certificates are valid or are configured correctly.

Event Details

Product: Windows Operating System
ID: 666
Source: Microsoft-Windows-ADFS
Version: 6.0
Symbolic Name: ProxyWebMethodAccessDeniedCertNotInTrustPolicy
Message: The Federation Service failed a privileged Web method call because the caller's client authentication certificate is not configured as a Federation Service Proxy certificate.
Certificate thumbprint: %1

User Action
Ensure that the trust policy is properly configured with all valid Federation Service Proxy certificates.

Resolve

Configure the trust policy with all valid federation server proxy client certificates

To perform this procedure, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority.

To ensure that the trust policy is properly configured with all valid federation server proxy certificates:

  1. Click Start, point to Administrative Tools, and then click Active Directory Federation Services.
  2. Double-click Federation Service, right-click Trust Policy, and then click Properties.
  3. On the FSP Certificates tab, check that the appropriate Federation Service Proxy certificates appear in the list.

For more information about federation server proxy certificates, see Certificates used by federation server proxies (https://go.microsoft.com/fwlink/?LinkId=64767).

Verify

A specific event (ID 674) should be generated on the federation server proxy computer if the federation server proxy is able to communicate successfully with the Federation Service.

To perform this procedure, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority.

To verify that the federation server proxy can communicate with the Federation Service:

  1. Log on to a client computer with Internet access.

  2. Open a browser window, and then type the Uniform Resource Locator (URL) for the Federation Service endpoint, along with the path to the clientlogon.aspx page that is stored on the federation server proxy.

  3. Press ENTER.

    At this point your browser should display the error message "Server Error in '/adfs' Application." This step is necessary to generate event message 674 to verify that the clientlogon.aspx page is being loaded properly by Internet Information Services (IIS).

  4. Log on to the federation server proxy.

  5. Click Start, point to Administrative Tools, and then click Event Viewer.

  6. In the details pane, double-click Application.

  7. In the Event column, look for event ID 674.

If the federation server proxy is configured properly, you see a new event in the Application log of Event Viewer, with the event ID 674. This event verifies that the federation server proxy was able to communicate successfully with the Federation Service.

Federation Service Proxy Communication

Active Directory Federation Services