Office 365 exhibits the password anti-pattern?

[Joost van Dijk]

On 13 okt. 2012, at 18:53, Tom Scavo <trscavo at gmail.com> wrote:

> There's been a lot of chatter on this list lately regarding Office
> 365. I've skimmed the relevant conversations but I don't understand
> the details. Now there's talk of Office 365 at work, so I'd like to
> know more.
> 
> I understand that Office 365 works with SAML ECP. If there's a single
> web page that gives a good 20,000 view of SAML ECP and Office 365,
> please post it here.
> 
> I hope I'm wrong but it seems that Office 365 exhibits the password
> anti-pattern. Is that true?

Yes. To support eg imap clients, a user's password is sent to Microsoft's servers first, and those servers use either ws-federation active profile or saml 2.0 ecp profile to authenticate the user.

It would of course have been much better if Microsoft would have implemented saml ECP in their client software (but then they would still have a problem with supporting other vendor"s clients)

Cheers,
--
Joost

> 
> Thanks,
> Tom
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 1912 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20121013/f15c1d1b/attachment.bin