Symptoms
"Value cannot be null. Parameter name: token" error in sharepoint embedded web parts
Diagnoses
An issuer entry and mappings for the sharepoint STS do not exist, and are causing the web parts to throw this error, as K2 cannot decrypt the user's SAML token.
Resolution
We verified the value for the Sharepoint STS thumbprint via the "Manage Issuers" form located in the smartforms designer site against the value provided via the following command run against the sharepoint management shell.
(Get-SPServiceApplication -Name SecurityTokenServiceApplication).SigningCertificateThumbprint
Once we verified that the thumbprint was correct, we attempted to authenticate, and checked the hostserver log for the token XML. We then, based on the information in the XML of the token, used that to configure mappings for the token appropriately, in this case based on UPN, as that was the value provided by the token. We also configured the identity provider claim based on the information provided by the IdP value in the claim token captured by the hostserver log.
Alternative to the manual setup, Support does have a script that automates this process, but requires a service restart.
