Office 365 exhibits the password anti-pattern?

[Mike Wiseman]

> >
> >It would of course have been much better if Microsoft would have
> >implemented saml ECP in their client software (but then they would
> >still have a problem with supporting other vendor"s clients)
> 
> They could also make the proxy software available for hosting by the home org. They
> already have a trust relationship set up between their STS system and the home IdPs,
> which means the proxy wouldn't change that situation any or make it more complex.
> 


We've spent a little time here thinking about this, my institution is a live at edu customer. We briefly discussed with Microsoft staff the possibility of replicating their 'federation gateway' on-prem - they seemed open to pursuing this but we've not made it a priority. We've also briefly discussed developing our own proxy - it seems a bit complex given the need for gateway functionality of the three client protocols: IMAPS, ActiveSync, and the Outlook client protocol (or is that ActiveSync too?). 

Mike  



Mike Wiseman
Manager, Information Security
Information + Technology Services
University of Toronto