shibidp ECP extension configuration: REMOTE_USER not set

[Ryan Suarez]

On 12-10-11 9:27 AM, Joost van Dijk wrote:
> Not sure if you already resolved your issues, but I believe that the 
> message in your log file:
>
> No return endpoint available for relying 
> partyurn:federation:MicrosoftOnline
>
> has nothing to do with your setup but is related to an issue with 
> Office 365.
> When a user connects to Microsoft's IMAP server, for example, he/she 
> sends a username and password for authentication that is subsequently 
> relayed to the user's IdP using the SAML ECP profile. That is, a SOAP 
> request is sent from Microsoft's servers to your IdP's ECP endpoint 
> (using HTTP Basic authentication), e.g.
>
> <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
>   <S:Body>
>     <samlp:AuthnRequest 
> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 
> ID="_73ffcfca-e08e-4a4c-88f5-2b8022c61bf2" 
> IssueInstant="2012-10-11T12:06:28.0084232Z" Version="2.0" 
> AssertionConsumerServiceIndex="2">
> <saml:Issuer>urn:federation:MicrosoftOnline</saml:Issuer>
>     </samlp:AuthnRequest>
>   </S:Body>
> </S:Envelope>
>
> The problem is (I think) that there is no ACS URL with index 2 listed 
> in Microsoft's Windows Azure AD metadata at
> https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml

In their example they have the following entry:

<AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://login.microsoftonline.com/login.srf" index="2" />

http://technet.microsoft.com/en-us/library/jj205463.aspx

Adding this in should fix the problem.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121012/d8d3f282/attachment.html