ADFS – Bad Request 400 in Internet Explorer

Today i have a customer that got an Bad Request Error 400, when he try to logon to ADFS from inside their own network, with domain connected computers.
The error is only showing up in Internet Explorer, witch lead me to it might be a kerberos thing.

The service account that run the ADFS services, is “ita_service_admin”.

So looking at that account with setspn i can see witch SPN is register to ita_service_admin account.

The where no SPN for the account. The ADFS url is: so i added the following SPN to ita_service_Admin account:

But I got an error saying that HOST/FS.YYY.DK already exist. So i look for the SPN in the domain

This Code, will show all SPN in use in you Active Directory

Find the SPN, and delete it from the account, i find the account under Administrator, so it looks like someone have change the service account for ADFS service from Administrator to ITA_SERVICE_ADMIN account in the past, without moving the SPN.

So delete the SPN from administrator account

Then try to add it again to ITA_Service_Admin account.

Restart the ADFS service, and the ADFS is working again also from Internet Explorer.

You may also like...

Leave a Reply

Your email address will not be published. Required fields are marked *