Event ID 685 — Federation Server Communication

  • Article

Applies To: Windows Server 2008 R2

Federation Server communication is communication between federation servers and federation server proxies. A federation server proxy should be updated from the Federation Service. Federation Server communication fails if the federation server proxy cannot be updated and the information in the trust policy is configured incorrectly.

Event Details

Product: Windows Operating System
ID: 685
Source: Microsoft-Windows-ADFS
Version: 6.1
Symbolic Name: ExceptionFromFedServerTrustFailure
Message: The Federation Service Proxy was not able to update trust information from the Federation Service. The Federation Service's Secure Sockets Layer (SSL) server certificate could not be validated.
Federation Service URL: %1

User Action
Verify that the Federation Service's SSL server certificate chains to a root certificate that is in the Local Computer Trusted Root Certification Authorities certificate store in the Federation Service Proxy.

Verify that the SSL server certificate is neither expired nor revoked.

Verify that the SSL server certificate subject matches the host name portion of the Federation Service Uniform Resource Locator (URL).

Resolve

Examine the SSL server certificate

Check that the federation server's Secure Sockets Layer (SSL) server certificate, which is defined in Internet Information Services (IIS) for single sign-on (SSO), chains to a root certificate that is in the Local Computer Trusted Root Certification Authorities certificate store in the federation server proxy.

Check that the SSL server certificate is neither expired nor revoked.

Check that the SSL server certificate subject matches the host name portion of the Federation Service Uniform Resource Locator (URL).

For more information about the Federation Service SSL certificate, see Certificates used by federation servers (https://go.microsoft.com/fwlink/?LinkId=64791).

Verify

Verify that a specific event (ID 674) was generated on the federation server proxy computer. This event is generated when the federation server proxy is able to successfully communicate with the Federation Service.

To perform this procedure, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority.

  1. Log on to a client computer with Internet access.

  2. Open a browser window, and then type the Uniform Resource Locator (URL) for the Federation Service endpoint, along with the path to the clientlogon.aspx page that is stored on the federation server proxy.

  3. Press ENTER.

    Note   At this point your browser should display the error Server Error in '/adfs' Application. This step is necessary to generate event message 674 to verify that the clientlogon.aspx page is being loaded properly by Internet Information Services (IIS).

  4. Log on to the federation server proxy.

  5. Click Start, point to Administrative Tools, and then click Event Viewer.

  6. In the details pane, double-click Application.

  7. In the Event column, look for event ID 674.

If the federation server proxy is configured properly, you see a new event in the Application log of Event Viewer, with the event ID 674. This event verifies that the federation server proxy was able to communicate successfully with the Federation Service.

Federation Server Communication

Active Directory Federation Services