Forum Discussion

JBlogs_314812's avatar
Icon for Nimbostratus rankNimbostratus
Mar 24, 2017

Office 365 SAML token rejection

I have configured the Office 365 SAML iApp for authentication, and to all intents and purposes it looks as though APM is successfully authenticating a user and issuing a token. However when the token is submitted to Office 365 I receive the response:


Sorry but we're having trouble signing you in. We've received a bad response.


AADSTS50000 there was an error issuing a token.


I'm using a URI as an identified as opposed to a URN. I've investigated as much as I can (but by no means and expert) confirming certificate thumbprints are uploaded to O365, time is in sync. I have dug into the http requests with Fiddler. I can see the SAML request and response. I see it submitted in the header to O365. Verified users are synchronised to Azure AD. Furthermore I've checked for additional proceeding slashes in the configuration between APM & O365.


Really struggling to understand the problem. Any suggestions/ help would be greatly appreciated.


9 Replies

  • kunjan's avatar
    Icon for Nimbostratus rankNimbostratus

    What is the value configured for 'Assertion Subject Value*:' on APM. ? May want to verify with MS on this value.


  • kunjan's avatar
    Icon for Nimbostratus rankNimbostratus

    Okay, so that should be something required by O365? Any concern in configuring with a ending slash?


  • I did find this issue with O365, not with other SP's I have configured Also, as SP number grew, I had problems ending entityID in a URI like /idp/ or similar (can't remember why at this moment, maybe I was doing something wrong), so finally ended setting up every idp service with entityID as


  • Also you must call an iRule to encode attribute to b64. Let me know if you don't have the code


  • Thanks for the comments. I have this working now, it was an issue with the encode irule, more specifically the AD query wasn't returning the attributes needed for the irule. Worth noting, I don't have a trailing slash, but both APM & o365 configurations match. Thanks for the help.


  • Maybe if entityID includes an uri like /idp this problem does not come out. Do you have it ? But we had at both places and until we added the slash it didn't work