Forum Discussion

Juramirez's avatar
Juramirez
Resolver I
8 years ago

Parsing WS-Trust Power BI embedded

Hi all   I'm having a problem when embedding a report, the following excepction appears: parsing_wstrust_response_failed: Parsing WS-Trust response failed    What could it be?   Regards J.
Need Help
Show and Tell
Tips and Tricks
Tutorial Requests
Anonymous's avatar
Anonymous
Not applicable
8 years ago

DId an nslookup on analysis.windows.net.... No answer. Strange, this is...

annafsh's avatar
annafsh
Regular Visitor
8 years ago

In our case, ADFS was blocked for passive authentication requests from outside the network. 

 

Try to enable ADAL logging to check where the error comes from.

  • Anonymous's avatar
    Anonymous
    Not applicable
    8 years ago

    Seems you're right. Busy troubleshooting with MS and it seems to be related to ADFS. They also suggested direct authentication. More updates to follow...

  • Anonymous's avatar
    Anonymous
    Not applicable
    8 years ago

     

     

    The sample I'm using is using Resource owner password credentials flow for authentication. With this authentication flow, my application just sends the username and password to Azure AD. However, Azure AD using WS-Trust with ADFS to send username or password. However the ROPC has some limitations and it may not work for this federated user accounts.

     

    Microsoft suggests this:

     

    You can try to use Direct Authentication for federated user accounts if you cannot use WS-trust.

     

    Azure AD has turned off the ability (by default) for customers to utilize the legacy-based authentication method of Direct Authentication for federated user accounts.

     

    Direct Authentication for federated user accounts is the means of utilizing an Azure AD stored Password Hash to authenticate a federated user directly with Azure AD and retrieving a token from us without being sent to the Identity Provider for the account. As you probably have noticed, this ‘feature’ isn’t the best from a security perspective.

     

    There is a way to turn this back on for the customer but we recommend you only do so on a per-app basis since the nature of this change will open the customer up to legacy authentication mechanisms for their entire tenant. The script supplied to customers who have one (1) application to turn this on with is as follows:

     

    1. Enable both of Password hash synchronization and  Federation with ADFS in Azure AD Connect sync.
    1. Install the Azure AD Preview PowerShell Module.
    1. Run the following line-by-line (making sure the variable $sp doesn’t have more than 1 application as a result)

    Connect-AzureAD

    $sp = Get-AzureADServicePrincipal -SearchString "Name_Of_Application"

    $policy = New-AzureADPolicy -Definition @("{`"HomeRealmDiscoveryPolicy`":{`"AllowCloudPasswordValidation`":true}}") -DisplayName EnableDirectAuth -Type HomeRealmDiscoveryPolicy -IsOrganizationDefault $false

    Add-AzureADServicePrincipalPolicy -Id $sp.ObjectId -RefObjectId $policy.Id

     

    HTH!

  • dudess's avatar
    dudess
    Regular Visitor
    8 years ago

    Anonymous, Can you please update how this issue is being addressed? applying HRD policy is not an option our security guys are entertaining.