User keeps prompting for password

I'd suspect that you use custom certificates (as opposed as the default self-signed) and that the Token Encrypting certificate you use in your ADFS deployment does not have the proper KeySpec. If the KeySpec is not set to 1 (AT_KEYEXCHANGE), you can't use Form Based Authentication as ADFS can't encrypt stuff. This will fail because ADFS used that certificate in the process. It will just loop. This certificate is not used when you use Windows Integrated Authentication. Hence you don't have the problem internally if the browser support Windows SSO (Kerberos/NTLM).

Anyhow, run the following PowerShell cmdLets on your primary ADFS server to determine the KeySpec of your Token Decrypting cert:

$cert = (Get-AdfsCertificate -CertificateType Token-Decrypting).Thumbprint
certutil -v -store My $cert | Where-Object {$_ -like "*KeySpec*"}

If the output is not:

    KeySpec = 1 -- AT_KEYEXCHANGE

Then we found our problem. And we can fix it by re-importing the certificate. You would delete from the store (you can use the MMC) and re-import it with specifying the KeySpec like:

certutil -importpfx Token-Decrypting.pfx AT_KEYEXCHANGE

Let us know! 🤞

Hi @Pierre Audonnet - MSFT

Thank you for the advise, its really worth information. In our case we are using self-signed certificate for Token and signining (which doesnt have kepspec attribute it seem) and we do have our CA generated certificate (KeySpec = 1 -- AT_KEYEXCHANGE) but this is set as secondary. Primary is the self signed one.

Could the issue be because this attribute is not present on the self signed? Also the wap is being used by MDM when user access email from mobile but it uses Activesync so i guess is not modern auth, and so no browser authentication, correct me if wrong.

May I know what could be other cause if not related to Keyspec