Skip to content

Commit 42c5dc9

Browse files
genlingenlin
committed
update the article
1 parent 0263060 commit 42c5dc9

1 file changed

Lines changed: 24 additions & 27 deletions

File tree

‎support/entra/entra-id/app-integration/error-code-aadsts7500514-supported-type-saml-response-not-found.md‎

Lines changed: 24 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: AADSTS7500514 - A supported type of SAML response was not found with PingFederate
3-
description: Describes an error code `AADSTS7500514` that's returned if a federated account try to authenticate with Microsoft Entra ID.
3+
description: Describes an error code `AADSTS7500514` that's returned if a federated account tries to authenticate with Microsoft Entra ID.
44
ms.date: 04/17/2025
55
ms.author: bachoang
66
ms.service: entra-id
@@ -10,11 +10,11 @@ keywords: AADSTS50020
1010

1111
# AADSTS7500514 - A supported type of SAML response was not found with PingFederate
1212

13-
This article helps you troubleshoot error code `AADSTS7500514` that's returned if a PingFederate federated account try to authenticate with Microsoft Entra ID (formerly Azure Active Directory).
13+
This article helps you troubleshoot error code `AADSTS7500514` that's returned if a PingFederate federated account tries to authenticate with Microsoft Entra ID (formerly Azure Active Directory).
1414

1515
## Symptoms
1616

17-
When a federated account tries to authenticate with an Microsoft Authentication Library (MSAL) or Active Directory Authentication Library (ADAL) based application, the sign-in fails. The following error message is displayed:
17+
When a federated account tries to authenticate with Microsoft Entra ID from a Microsoft Authentication Library (MSAL) or Active Directory Authentication Library (ADAL) based application, the sign-in fails. The following error message is displayed:
1818

1919
```output
2020
{
@@ -27,22 +27,22 @@ When a federated account tries to authenticate with an Microsoft Authentication
2727

2828
The error typically occurs in the following environment:
2929

30-
- A federated account that uses [PingFederate](https://www.pingidentity.com/software/pingfederate.html) as the identity provider is used for authentication.
30+
- A federated account that uses [PingFederate](https://www.pingidentity.com/software/pingfederate.html) as the identity provider.
3131
- The identity provider is configured to issue a SAML 1.1 token by using the WS-Trust protocol.
3232
- The application uses one of the following APIs for authentication:
33-
- MSAL `AcquireTokenByUserNamePassword` method
34-
- ADAL `AcquireToken`(string resource, string clientId, UserCredential userCredential) method
33+
- MSAL `AcquireTokenByUserNamePassword` method.
34+
- ADAL `AcquireToken`(string resource, string clientId, UserCredential userCredential) method.
3535
- Any PowerShell module that uses the MSAL or ADAL methods listed earlier.
3636

3737
## Cause
3838

39-
Since [ADAL has been deprecated](/entra/identity/monitoring-health/recommendation-migrate-from-adal-to-msal), this article focus on the MSAL.
39+
Since [ADAL has been deprecated](/entra/identity/monitoring-health/recommendation-migrate-from-adal-to-msal), this article focuses on the MSAL.
4040

4141
This issue occurs if the SAML response from PingFederate does not contain the SAML version or uses a format that MSAL cannot recognize. This typically results from a misconfiguration on the PingFederate side for Microsoft Entra ID.
4242

43-
### How the issue occurs
43+
### Root cause analysis: SAML token version detection
4444

45-
When authenticating a federated account, MSAL determines whether the account is managed account or federated account.
45+
When authenticating a federated account, MSAL determines whether the account is a managed account or a federated account.
4646

4747
For managed accounts, MSAL uses the [Resource Owner Password Credentials grant flow](/entra/identity-platform/v2-oauth-ropc). For federated accounts, it uses the [SAML Assertion Grant flow](/azure/active-directory/develop/v2-saml-bearer-assertion) for authentication.
4848

@@ -56,7 +56,7 @@ The issue typically occurs in step 1, where the client application needs to pars
5656
- `<saml:Assertion>` node
5757
- `<TokenType>` node
5858

59-
The following is an example AD FS SAML response from the `usernamemixed` endpoint:
59+
The following is an example AD FS SAML response from the `/UserNameMixed` endpoint:
6060

6161
- **SAML Assertion**: major version = 1, minor version = 1
6262
- **TokenType**: `urn:oasis:names:tc:SAML:1.0:assertion`
@@ -65,32 +65,32 @@ The following is an example AD FS SAML response from the `usernamemixed` endpoi
6565

6666
Example of PingFederate SAML response (SAML Assertion Grant flow step 1):
6767

68-
:::image type="content" source="media/error-code-aadsts7500514-supported-type-saml-response-not-found/pingid-saml-response.png" alt-text="AScreenshot of PingFederate SAML Response" lightbox="media/error-code-aadsts7500514-supported-type-saml-response-not-found/pingid-saml-response.png":::
68+
:::image type="content" source="media/error-code-aadsts7500514-supported-type-saml-response-not-found/pingid-saml-response.png" alt-text="A screenshot of PingFederate SAML Response for SAML Assertion Grant flow step 1" lightbox="media/error-code-aadsts7500514-supported-type-saml-response-not-found/pingid-saml-response.png":::
6969

70-
After you compare these two response, you will found PingFederate returns a different TokenType value: `http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1` for the same SAML 1.1 token. However, MSAL does not support any TokenType value other than `urn:oasis:names:tc:SAML:1.0:assertion`.
70+
After you compare these two responses, you will find PingFederate returns a different TokenType value: `http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1` for the same SAML 1.1 token. However, MSAL does not support any TokenType value other than `urn:oasis:names:tc:SAML:1.0:assertion`.
7171

7272
When the identity provider returns a different or unexpected value in the SAML response, MSAL may incorrectly interpret the token as SAML 2.0. As a result, it uses the corresponding `grant_type` value during step 2 of the SAML Assertion Grant flow.
7373

74-
Example of the request sent from MASL application with PingFederate (SAML Assertion Grant flow step 2):
74+
Example of the request sent from MSAL application with PingFederate (SAML Assertion Grant flow step 2):
7575

76-
:::image type="content" source="media/error-code-aadsts7500514-supported-type-saml-response-not-found/pingid-saml-response-2.png" alt-text="AScreenshot of PingFederate SAML Response" lightbox="media/error-code-aadsts7500514-supported-type-saml-response-not-found/pingid-saml-response-2.png":::
76+
:::image type="content" source="media/error-code-aadsts7500514-supported-type-saml-response-not-found/pingid-saml-response-2.png" alt-text="A screenshot of request sent from MSAL application with PingFederate in SAML Assertion Grant flow step 2." lightbox="media/error-code-aadsts7500514-supported-type-saml-response-not-found/pingid-saml-response-2.png":::
7777

78-
Example of the request sent from MASL application with AD FS :
78+
Example of the request sent from MSAL application with AD FS :
7979

80-
:::image type="content" source="media/error-code-aadsts7500514-supported-type-saml-response-not-found/pingid-saml-response-3.png" alt-text="AScreenshot of PingFederate SAML Response" lightbox="media/error-code-aadsts7500514-supported-type-saml-response-not-found/pingid-saml-response-3.png":::
80+
:::image type="content" source="media/error-code-aadsts7500514-supported-type-saml-response-not-found/pingid-saml-response-3.png" alt-text="A screenshot of request sent from MSAL application with AD FS in SAML Assertion Grant flow step 2." lightbox="media/error-code-aadsts7500514-supported-type-saml-response-not-found/pingid-saml-response-3.png":::
8181

8282
In this step, the value of the `grant_type` parameter must align with the actual version of the SAML token. The following values are used:
8383

84-
- `urn:ietf:params:oauth:grant-type:saml2-bearer` – for SAML 2.0 tokens
85-
- `urn:ietf:params:oauth:grant-type:saml1_1-bearer` – for SAML 1.1 tokens
84+
- urn:ietf:params:oauth:grant-type:saml2-bearer - for SAML 2.0 tokens
85+
- urn:ietf:params:oauth:grant-type:saml1_1-bearer - for SAML 1.1 tokens
8686

87-
In the case of a PingFederate account, MSAL uses the incorrect `grant_type` based on its misinterpretation of the SAML version. This results in a version mismatch between the `grant_type` parameter and the SAML token included in the assertion that causes the authentication error.
87+
In the case of a PingFederate account, MSAL uses the `saml2-bearer` as the `grant_type` based on its misinterpretation of the SAML version. This results in a version mismatch between the `grant_type` parameter and the SAML token included in the assertion that causes the authentication error.
8888

89-
## SOlution
89+
## Solution
9090

91-
To resolve this issue, ensure that PingFederate is configured to align with Microsoft Entra ID requirements. Follow the steps below:
91+
To resolve this issue, ensure that PingFederate is configured to align with Microsoft Entra ID requirements. For step-by-step instructions, review the following articles.
9292

93-
- [Creating a connection to Microsoft Entra ID](https://docs.pingidentity.com/integrations/azure/azure_ad_and_office_365_integration_guide/pf_azuread_office365_integration_creating_a_connection_to_azure_active_directory.html)
93+
- [Creating a connection to Microsoft Entra ID](https://docs.pingidentity.com/integrations/azure/azure_ad_and_office_365_integration_guide/pf_azuread_office365_integration_creating_a_connection_to_azure_active_directory.html).
9494

9595
During Microsoft Entra ID connection setup, pay special attention to the following settings:
9696

@@ -103,9 +103,6 @@ To resolve this issue, ensure that PingFederate is configured to align with Micr
103103

104104
- [Configuring WS-Trust STS](https://docs.pingidentity.com/integrations/azure/azure_ad_and_office_365_integration_guide/pf_azuread_office365_integration_configuring_ws_trust_sts.html)
105105

106-
During Configuring WS-Trust STS, select **SAML 1.1 for Office 365** as the Default Token Type.
106+
When you configure WS-Trust STS, make sure that you select **SAML 1.1 for Office 365** as the Default Token Type.
107107

108-
109-
## Clean up resources
110-
111-
After resolving the issue, test the changes in your environment to ensure that the error no longer occurs when using MSAL or ADAL for authentication. Make any necessary adjustments to your application's authentication logic as needed.
108+
[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)]

0 commit comments

Comments
 (0)