AD FS – Troubleshooting Wap trust error The remote server returned an error: (400) Bad Request

Hi mates. Today we’re going to cover the error message The remote server returned an error: (400) Bad Request when you are configuring trust between WAP and AD FS server.

Scenario: In this demonstration, we are going to cover the troubleshooting using:
– AD FS version 2019
– WAP version 2019
– WID Database

Get detailed information on WAP server

With the AD FS Tracing debug enabled on the WAP, you might be able to see events below:

Error message on AD FS Tracing/Debug:

Error: Exception: An error occurred when attempting to establish a trust relationship with the federation service. Error: Bad Request
StackTrace: at Microsoft.IdentityServer.Management.Proxy.Providers.ProxyTrustProvider.EstablishTrustWithSts(ICredentials credentials, String thumbprint)
at Microsoft.IdentityServer.Deployment.Core.Tasks.ConfigurationTaskBase.Execute(IDeploymentContext context, IProgressReporter progressReporter)
Exception: The remote server returned an error: (400) Bad Request.
StackTrace: at System.Net.HttpWebRequest.GetResponse()
at Microsoft.IdentityServer.Management.Proxy.Providers.ProxyTrustProvider.EstablishTrustWithSts(ICredentials credentials, String thumbprint)

Result: Status – Error, Message – An error occurred while attempting to establish a trust relationship with the Federation Server. An error occurred when attempting to establish a trust relationship with the federation service. Error: Bad Request, Context – DeploymentTask

Error message checking Event viewer » AD FS Tracing/Debug on secondary AD FS server:

ProxyServerRequestHandler.ProcessContext: WebException returned : Exception: The remote server returned an error: (400) Bad Request.
StackTrace: at System.Net.HttpWebRequest.GetResponse()
at Microsoft.IdentityServer.Web.Proxy.PrimaryServerRequestHandler.ProcessContext(WrappedHttpListenerContext context, String authenticationAuditInformation)

Troubleshooting

On WAP server, check if the server responding to the WAP request is the primary or secondary server. If the farm uses WID database and the request is reaching the secondary server, let’s make some checks:

1 – Ping the federation service name fs.contoso.com

2 – If the WAP server is reaching the secondary AD FS server, check the sync information on it running command below:

Get-AdfsSyncProperties

Fix the sync configuration

As we identified above, the parameter PrimaryComputerName is configured with the server name and not the FQDN as required in this document.

To fix it, let’s run command below on the secondary AD FS server in order to configure the correct FQDN of the primary AD FS server on parameter PrimaryComputerName.

Set-AdfsSyncProperties -Role SecondaryComputer -PrimaryComputerName WS-AD FS.FQDN

Wait at least 5 minutes for the first sync to occur and run command below again with the correct FQDN of the primary AD FS server:

Get-AdfsSyncProperties

Establish the proxy trust

With the correct FQDN configured on the secondary AD FS server, run the command below on WAP to establish the trust:

$FScredential = Get-Credential
Install-WebApplicationProxy -FederationServiceName “fs.contoso.com” -FederationServiceTrustCredential $FScredential -CertificateThumbprint “EC73A6E83751E03FE111B7592D035B0966F7”

On Event viewer, to confirm the trust has been established correctly, you might be able to see event ID 245 as below:

AD FS/AdminLog Name: AD FS/Admin
Source: AD FS
Event ID: 245
Task Category: None
Level: Information
Keywords: AD FS
User: NETWORK SERVICE
Description:
The federation server proxy successfully retrieved and updated its configuration from the Federation Service ‘fs.contoso.com’.

Summary

In this article, we covered how to troubleshoot the error message The remote server returned an error: (400) Bad Request when you are configuring trust between the Web Application Server and AD FS..

I hope you have enjoyed reading this article, and it helps you to manage your AD FS environment.

Enjoyed the article? Like and share. 🙂

Note: I do not represent the organization I work for, all the opinions expressed here, are my own. This post is provided AS IS with no warranties or guarantees and confers no rights.

In case you have any suggestion or feedback, please leave a comment.

[ ]’s

Ulysses Neves