Troubleshooting: WinSSO Realm's Federation Metadata Shows 'The Resource Cannot Be Found'

Version Affected: All
 
 

Overview

Trying to view a Windows SSO (WinSSO) realm's Federation Metadata (for example, at /SecureAuth2/FederationMetadata/2007-06/FederationMetadata.xml) can fail with:

Server Error in '/SecureAuth2' Application. The resource cannot be found.

If the realm is instead configured for Forms Based Authentication (FBA), this error does not occur and the metadata XML loads normally.

Cause

A WinSSO realm typically has User Impersonation enabled. The virtual path to /FederationMetadata/2007-06/ inherits this impersonation setting from the root of the realm's IIS virtual directory.

Resolution:

Disable impersonation specifically for the FederationMetadata/2007-06 virtual path:

1. On the realm's System Info tab, click Edit Web Config -- or decrypt the realm and edit web.config with a text editor instead.
2. Insert the following XML within the <location path="FederationMetadata/2007-06"> section:

<system.web>
  <identity impersonate="false" />
</system.web>

3. Save the changes.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.