Hi mates. Today we’re going to work on the error MSIS9605: The client is not allowed to access the requested resource. on AD FS when a hybrid device tries to get an Enterprise PRT.
To reproduce the issue, let’s consider the scenario below:
AD FS: 2019
Device Registration Service: Enabled
Client: Windows 10
Join type: Hybrid Join
Issue: Hybrid device not able to receive Enterprise PRT
Enterprise PRT
The Enterprise PRT can be used for device authentication on-premises when you have policies evaluating the device status. For hybrid Azure AD joined devices, the device could have PRT from both Azure AD and on-premises AD simultaneously. On-premises joined devices will only have an Enterprise PRT.
Troubleshooting
To identify if the device is not able to acquire the PRT, let’s run the command dsregcmd /status on the affected machine. We might get the output similar to this below:
+———————————————————————-+
| SSO State |
+———————————————————————-+
AzureAdPrt : YES
AzureAdPrtUpdateTime : 2021-05-31 15:35:27.000 UTC
AzureAdPrtExpiryTime : 2021-06-14 15:35:26.000 UTC
AzureAdPrtAuthority : https://login.microsoftonline.com/TenantID
EnterprisePrt : NO
EnterprisePrtAuthority : https://adfs2019.ulyneves.com:443/adfsOn the client’s event viewer:
You might see we see events 1025, 1118 and 1081 on event viewer looking for path Microsoft-Windows-AAD/Operational as below:
Http request status: 400. Method: POST Endpoint Uri: https://fs.contoso.com/adfs/oauth2/token/ Correlation ID: 225BEAC5-37F8-4A2E-8D2C-BA2A819FE2F3
OAuth response error: unauthorized_client
Error description: MSIS9605: The client is not allowed to access the requested resource.
Enterprise STS Logon failure. Status: 0xC000006D Correlation ID: 225BEAC5-37F8-4A2E-8D2C-BA2A819FE2F3
On AD FS server:
If AD FS Tracing logs are enabled, you might see we see events with ID 178 on event viewer looking for path AD FS Tracing/Debug as below:
An OAuth Access Token could not be issued for next generation credentials grant: to client ’38aa3b87-a06d-4817-b275-7a316988d93b’ for resource ‘http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope’.
The client IP is ‘X.X.X.X’
. The Exception encountered: ‘Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthUnauthorizedClientException: MSIS9368: Received invalid OAuth request. The client ’38aa3b87-a06d-4817-b275-7a316988d93b’ is forbidden to access the resource ‘http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope’ with scope ‘ugs’.
at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthProtocolContext.ValidateScopes(String scopeParameter, String clientId, String relyingPartyId)
at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthJWTBearerRequestContext.ValidateCore()
at Microsoft.IdentityServer.Web.Protocols.ProtocolContext.Validate()
at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthTokenProtocolHandler.PreAuthenticationProcess(ProtocolContext context)’
On AD FS Admin logs, you might see error message below:
The input parameters in the received OAuth JWT bearer Request are found to be invalid
Encountered error during OAuth token request.
Additional Data
Exception details:
Microsoft.IdentityServer.Web.Protocols.OAuth.Exceptions.OAuthUnauthorizedClientException: MSIS9368: Received invalid OAuth request. The client ’38aa3b87-a06d-4817-b275-7a316988d93b’ is forbidden to access the resource ‘http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope’ with scope ‘ugs’.
at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthProtocolContext.ValidateScopes(String scopeParameter, String clientId, String relyingPartyId)
at Microsoft.IdentityServer.Web.Protocols.OAuth.OAuthToken.OAuthJWTBearerRequestContext.ValidateCore()
Fix: As reported by Microsoft on this public documentation, AD FS running on Windows Server 2019 fails to complete device authentication properly due to an invalid check of incoming scopes in the request. Device authentication to AD FS is a requirement for Windows Hello for Business to enroll a certificate using AD FS. The client will block Windows Hello for Business provisioning until this authentication is successful.
This certificate issue on AD FS version 2019 can be fixed manually creating the scope on AD FS and configuring the application permissions.
Run the command below on the primary AD FS server using PowerShell:
Add-AdfsScopeDescription -Name ugs
$app = (Get-AdfsApplicationPermission -ServerRoleIdentifiers "http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope" | ?{ $_.ClientRoleIdentifier -eq "38aa3b87-a06d-4817-b275-7a316988d93b" }).ObjectIdentifier
Set-AdfsApplicationPermission -TargetIdentifier $app -AddScope 'ugs'
Restart-Service ADFSSRV
Validating the Enterprise PRT
With the scope created on AD FS, we do a fresh sign in and confirm the EnterprisePRT is issued by AD FS running command dsregcmd /status as below:
+———————————————————————-+
| SSO State |
+———————————————————————-+
AzureAdPrt : YES
AzureAdPrtUpdateTime : 2021-05-31 16:07:03.000 UTC
AzureAdPrtExpiryTime : 2021-06-14 16:07:02.000 UTC
AzureAdPrtAuthority : https://login.microsoftonline.com/tenantID
EnterprisePrt : YES
EnterprisePrtUpdateTime : 2021-05-31 16:07:04.000 UTC
EnterprisePrtExpiryTime : 2021-06-14 16:07:04.000 UTC
EnterprisePrtAuthority : https://fs.contoso.com:443/adfsOn AD FS server, checking the AD FS tracing logs, we see event ID 34 with messages below that confirms the client being able to retrieve the details on scope below:
| Successfully retrieved scope details for scope http://schemas.microsoft.com/ws/2009/12/identityserver/selfscope |
| Successfully retrieved scope details for scope urn:federation:MicrosoftOnline |
Summary
In this article, we covered how to workaround the AD FS error MSIS9605: The client is not allowed to access the requested resource. when a hybrid device tries to get an Enterprise PRT.
I hope you have enjoyed reading this article and it helps you manage your AD FS environment.
Enjoyed the article? Like and share. 🙂
Note: I do not represent the organization I work for, all the opinions expressed here, are my own. This post is provided AS IS with no warranties or guarantees and confers no rights.
In case you have any suggestion or feedback, please leave a comment.
[ ]’s
Ulysses Neves
