Troubleshooting: WSFederation Realm Shows "Not in Whitelist or Domains in Whitelist Are Malformed"

Version Affected: 9.2.0-36, 9.3.0-21, 19.07.01-30, 20.06-6, and later
 
 

Overview

A WSFederation realm logs Not in whitelist or domains in whitelist are malformed, similar to:

Url: https://mail.domain.com/ecp
Exception occurred: System.IdentityModel.Protocols.WSTrust.InvalidRequestException: Not in whitelist

The exception points to the wreply value not matching an allowed domain.

Cause

Starting with the hotfixes listed above, WSFederation realms whitelist the wreply field. A domain that isn't on the whitelist is blocked -- this is most often seen with Office 365 integrations, since most of those always use the wreply value.

Resolution:

The whitelist can be defined in either of two places:

• For a single domain, set the WSFed Reply To/SAML Target URL field -- this also acts as a wildcard for any other URLs on that same domain.
• For multiple domains, decrypt the web.config and add the following line to the appSettings section, as a comma-delimited list of hostnames only:

<add key="WsFedWhiteList" value="domain.com,mail.domain.com,anotherdomain.com" />

Special Considerations

The single-domain field is sufficient for the vast majority of cases -- only use the web.config appSetting when more than one domain needs to be whitelisted.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.