Pro & Cons of Shibboleth Authentication for Office 365

[Mauro Minella]

Hello Dematri,
answers inline.

Ciao

Mauro

a) Shibboleth is the front end for authentication however it uses Active Directory from LDAP perspective?
>> That's right. This version of Shibboleth relies on AD through the standard LDAP interface that AD offers, so AD might be replaced by any other directory service

b) Shibboleth.ps1 script file which is been used in Federation video no.5, can you share the same?
>> Here you go

Function ShibbolethFederation {
    $domainName = "shibdomain.eduteamit.com"
    $passiveLogOnUri = "https://shibidp.eduteamit.com/idp/profile/SAML2/POST/SSO"
    $activeLogOnUri = "https://shibidp.eduteamit.com/idp/profile/SAML2/SOAP/ECP"
    $issuerUri = "https://shibidp.eduteamit.com/idp/shibboleth"
    $logOffUrl = "https://shibidp.eduteamit.com/idp/logout"
    $tokenSigningCertificate = "MIIDPzCCAi (truncated)...="

    Set-MsolDomainAuthentication -DomainName $domainName -FederationBrandName $domainName -Authentication Federated  `
     -PassiveLogOnUri $passiveLogOnUri -SigningCertificate $tokenSigningCertificate -IssuerUri $issuerUri  `
     -ActiveLogOnUri $activeLogOnUri -LogOffUri $logOffUrl -PreferredAuthenticationProtocol SAMLP
}

c) Once federated to Shibboleth, is it that all trusted domains running on Office 365 will get authenticated through Shibboleth?
>> If you federate abc.edu.au with your federation server, then any users having this domain OR SUB-DOMAIN in the UPN will be directed to it

d) If yes in Point C, than we are looking for an alternate.
As we have different UPN for users, such that we wants users with UPN - @abc.edu.au to be get authenticated by Shibboleth. But UPN  - @alumni.abc.edu.au to be authenticated by Office 365 Identity management. Is this possible?
>> That's not possible, see previous point. I haven't tried, but in theory you may do the opposite (having only the sub-domain federated)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130603/7400355e/attachment.html