Hello, I am receiving the following error when accessing my FIM Portal sites. I had previously been able to use the portal. I have not performed any FIM updates on the server. Does anyone have any clues as to why this would have started throwing these errors. Thanks Bill The request for security token could not be satisfied because authentication failed. Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. Exception Details: System.ServiceModel.FaultException: The request for security token could not be satisfied because authentication failed. Source Error: An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below. Stack Trace: [FaultException: The request for security token could not be satisfied because authentication failed.] System.ServiceModel.Security.SecurityUtils.ThrowIfNegotiationFault(Message message, EndpointAddress target) +15493098 System.ServiceModel.Security.IssuanceTokenProviderBase`1.ThrowIfFault(Message message, EndpointAddress target) +18 System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState) +169 [SecurityNegotiationException: The caller was not authenticated by the service.] Microsoft.ResourceManagement.WebServices.Client.ResourceTemplate.EnumerateResources(SearchParameters parameters) +1605 Microsoft.IdentityManagement.WebUI.Controls.ConfigurationModelBase.RetrieveResources(String type, String filter, List`1 attributes) +499 [ServerDownException: Error connecting to server] Microsoft.IdentityManagement.WebUI.Controls.ConfigurationModelBase.RetrieveResources(String type, String filter, List`1 attributes) +1171 Microsoft.IdentityManagement.WebUI.Controls.PortalUIConfigurationModel.RetrievePortalUIConfiguration() +269 Microsoft.IdentityManagement.WebUI.Controls.PortalUIConfigurationModel.get_PortalUI() +118 Microsoft.IdentityManagement.WebUI.Controls.PortalUIConfigurationModel.get_BrandingLeftImageUrl() +16 Microsoft.IdentityManagement.WebUI.Controls.BrandBar.get_BrandTable() +117 Microsoft.IdentityManagement.WebUI.Controls.BrandBar.CreateChildControls() +32 System.Web.UI.Control.EnsureChildControls() +146 System.Web.UI.Control.PreRenderRecursiveInternal() +61 System.Web.UI.Control.PreRenderRecursiveInternal() +224 System.Web.UI.Control.PreRenderRecursiveInternal() +224 System.Web.UI.Control.PreRenderRecursiveInternal() +224 System.Web.UI.Control.PreRenderRecursiveInternal() +224 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +3394

Are all user accounts affected? The ServerDownException surely indicates something- though I'm not sure what. It may help to increase kerberos and security logging so you can trace what is happening with the authentication attempt.http://www.wapshere.com/missmiis

How is your evironment configured, do you have multiple FIM services running on several servers? Need realtime FIM synchronization? check out the new http://www.traxionsolutions.com/imsequencer that supports FIM 2010 and Omada Identity Manager real time synchronization!

Hi, I have FIM running on a single box (other than sql). The SQL server is on a separate box. I have gone so far as removing the portal completly along with WSS. After a reinstall I am still receiving the error. Bill

Carol, don't you ever recall having this specific error? :D Do you have the required MPRs enabled: Only local admin can login - no domain users at all/ Do you have the required attributes present in the portal for the user trying to log on: Portal Login Error for Normal User http://setspn.blogspot.com

Hello, I continue to get this error when accessing the portal via: http://fim.mydomain.com however if I use http://localhost I can access the portal and use it. I had not tried this before. However I am unable to use the portal from other hosts (obvously). This is also a new condition. Has anyone seen this before? Any ideas on resolving this? Thanks Bill

Hello, I continue to get this error when accessing the portal via: http://fim.mydomain.com however if I use http://localhost I can access the portal and use it. I had not tried this before. However I am unable to use the portal from other hosts (obvously). This is also a new condition. Has anyone seen this before? Any ideas on resolving this? Thanks Bill

I have defined and SPN for the HTTP/fim.mydomain.com Perhaps that is misconfigured. Thanks Bill

I have defined and SPN for the HTTP/fim.mydomain.com Perhaps that is misconfigured. Thanks Bill

You also added FIMService/<alias> <domain>\<serviceaccount> and turned on Kerberos Delegation for the FIMService? To establish the SPNs for the FIM Service Establish the SPNs for the FIM Service by running the following command: setspn S FIMService/<alias> <domain>\<serviceaccount> The <alias> above is the address that is entered during FIM Service setup and used by the clients and the FIM Portal to contact the Web Service. This can be a CNAME or host (A) resource record in DNS. If you are using Network Load Balancing (NLB), this is the name of the cluster. The <serviceaccount> above is the account that is used by the FIM Service. If you are using several different namesfor instance, fully qualified domain names (FQDNs) and NetBIOS namesto contact the server, repeat the steps for every name. Turn on Kerberos delegation for the FIM Service service account in AD DS. You can turn on delegation for all services either by selecting Trust this user for delegation to any service (not recommended) or by using constrained delegation (recommended) by selecting Trust this user for delegation to the specified services only. If you use constrained delegation, search for the FIM Service service account, and then select the entry that you added in the previous step. Need realtime FIM synchronization? check out the new http://www.traxionsolutions.com/imsequencer that supports FIM 2010 and Omada Identity Manager real time synchronization!

Hello, I had done these steps as well. I finally removed the FIM Portal and Service from the machine. Removed WSS as well. Cleaned up all the databases on my SQL server. After reinstalling WSS and creating a web application on it I tried to install the portal and service again. Still the same error. Still receivning this error int he event log Log Name: Application Source: Microsoft.ResourceManagement.PortalHealthSource Date: 5/26/2011 9:34:29 PM Event ID: 10 Task Category: None Level: Error Keywords: Classic User: N/A Computer: manage.mydomain,com Description: The Portal cannot connect to the middle tier using the web service interface. This failure prevents all portal scenarios from functioning correctly. The cause may be due to a missing or invalid server url, a downed server, or an invalid server firewall configuration. Ensure the portal configuration is present and points to the resource management service. Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft.ResourceManagement.PortalHealthSource" /> <EventID Qualifiers="0">10</EventID> <Level>2</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2011-05-27T01:34:29.000000000Z" /> <EventRecordID>64838</EventRecordID> <Channel>Application</Channel> <Computer>manage.mydomain.com</Computer> <Security /> </System> <EventData> <Data>The Portal cannot connect to the middle tier using the web service interface. This failure prevents all portal scenarios from functioning correctly. The cause may be due to a missing or invalid server url, a downed server, or an invalid server firewall configuration. Ensure the portal configuration is present and points to the resource management service.</Data> </EventData> </Event>

Did you see this post? http://social.technet.microsoft.com/Forums/en-US/ilm2/thread/b8fae069-218f-4dfd-bb66-54bcb63b0386 Also check that the alternate access mappings specified in Sharepoint matches the HTTP SPN - I've seen some weird errors when this wasn't the case. http://technet.microsoft.com/en-us/library/cc288173(office.12).aspx http://www.wapshere.com/missmiis

Did you see this post? http://social.technet.microsoft.com/Forums/en-US/ilm2/thread/b8fae069-218f-4dfd-bb66-54bcb63b0386 Also check that the alternate access mappings specified in Sharepoint matches the HTTP SPN - I've seen some weird errors when this wasn't the case. http://technet.microsoft.com/en-us/library/cc288173(office.12).aspx http://www.wapshere.com/missmiis

I would take a few steps back: if you cleaned out everything and installed WSS. Even before you start installing FIM, you should be able to use Kerbers to log on to "http://yourfimportalurl". Surfing to the root should give you the sharepoint interface. If even that doesnt works there's only few places to look: SPN on Application Pool identity is wrong, or configured on two accounts. Did you set "useAppPoolCredentials=true" in the applicationHost.config? Or are you using a CNAME to access your portal? http://setspn.blogspot.com