title: ADFS 2.0 - request token for service in different AD
body: <p>I have the following scenario:</p>
  
  <p>Active Directory 1: WCF Client, ADFS 2.0 (STS)</p>
  
  <p>Active Directory 2: WCF service (Relying Party)</p>
  
  <p>I have added the RP to the ADFS but when I request a token from the ADFS I recieve the following error: System.ServiceModel.FaultException: ID3242: The security token could not be authenticated or authorized.</p>
  
  <p>Looking at the event log of the ADFS I find the matching error:</p>
  
  <blockquote>
    <p>An error occurred during an attempt to build the certificate chain for
    the relying party trust 'http://XXXXX/Service1/' certificate
    identified by thumbprint 'XXXXXXXXXXXX'. Possible causes are that the
    certificate has been revoked, the certificate chain could not be
    verified as specified by the relying party trust's encryption
    certificate revocation settings or certificate is not within its
    validity period. </p>
    
    <p>You can use Windows PowerShell commands for AD FS 2.0 to configure the
    revocation settings for the relying party encryption certificate. 
    Relying party trust's encryption certificate revocation settings:
    CheckChainExcludeRoot  The following errors occurred while building
    the certificate chain:   Unknown error. Unknown error.</p>
    
    <p>User Action:  Ensure that the relying party trust's encryption
    certificate is valid and has not been revoked.  Ensure that AD FS 2.0
    can access the certificate revocation list if the revocation setting
    does not specify "none" or a "cache only" setting.   Verify your proxy
    server setting. For more information about how to verify your proxy
    server setting, see the AD FS 2.0 Troubleshooting Guide
    (http://go.microsoft.com/fwlink/?LinkId=182180).</p>
  </blockquote>
  
  <p>Looks like the ADFS does not trust the signing certificate from the RP (understandable, the CA which issued the Signing certificate is in a different AD).
  The CertificateRevokationList is reachable from both Active Directories.</p>
  
  <p>I have added the CA certificate to the Trusted Root Certificates of the "Local Computer", but I think the problem is the validation mechanism.</p>
  
  <p>What do I have to configure to get the ADFS to issue a token signed with the proper certificate or how can I convince the ADFS that the certificate is valid?</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>I have tried changing the revokation check with the powershell command:</p>
  
  <pre><code> Set-ADFSRelyingPartyTrust  -SigningCertificateRevocationCheck CheckEndCert
  </code></pre>
  
  <p>but with no luck:
  Set-ADFSRelyingPartyTrust : Parameter set cannot be resolved using the specified named parameters.</p>
  
  <pre><code>At line:1 char:26
  + Set-ADFSRelyingPartyTrust &lt;&lt;&lt;&lt;   -SigningCertificateRevocationCheck CheckEndCert
      + CategoryInfo          : InvalidArgument: (:) [Set-ADFSRelyingPartyTrust], ParameterBindingException
      + FullyQualifiedErrorId : AmbiguousParameterSet,Microsoft.IdentityServer.PowerShell.Commands.SetRelyingPartyTrustC
     ommand
  </code></pre>
  
  <p><strong>EDIT 2</strong>:
  This worked: </p>
  
  <pre><code>(Get-ADFSRelyingPartyTrust) | Set-ADFSRelyingPartyTrust  -EncryptionCertificateRevocationCheck CheckEndCert
  </code></pre>
  
  <p>but now my client in Active Directory 1 complains about the certificate...</p>
  
  <blockquote>
    <p>System.ServiceModel.Security.SecurityNegotiationException: SOAP
    security negotiation with
    'http://XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/Service1/' for target
    'http://XXXXXXXXXXXXXXXXX/Service1/' failed.  See inner exception for
    more details. --->
    System.IdentityModel.Tokens.SecurityTokenValidationException: The
    X.509 certificate CN=RP-Service chain building failed. The certificate
    that was used has a trust chain that cannot be verified. Replace the
    certificate or change the certificateValidationMode. A certificate
    chain could not be built to a trusted root authority.</p>
  </blockquote>