Shibboleth for Office 365 (Authentication decision)

[Nate Klingenstein]

Dematri,

Looking for valuable advice for the below scenario in order to implement Shibboleth for Office 365.

The best advice I can offer is to please encourage Microsoft to work on their implementation/documentation so we don't have to field so many Office 365 questions.


a)      Our Shibboleth is getting authenticated by LDAP – SUN Enterprise Directory 5.2. Therefore from Shibboleth Federation with Office 365 perspective, can it use the same LDAP to authenticate users rather than AD?

The account information coming from Shibboleth will need to match the account information provisioned to Microsoft(for now, with a strange little tool called DirSync).  If your data in both matches, then you can use the same LDAP.


b)      If yes, then the attribute for authentication can be the user login id rather email address, as we are using it currently.

Office365 wants an "ImmutableID" for your users.  You will need to decide what identifier is most immutable, unreassigned, persistent, etc. and send it.  It needs to, again, match the back-channel provisioning.

However I understand for SSO to Office 365 you need to provide email address. Is it possible to have the email address in the background provided by Shibboleth to Office 365?

It's not clear to me that they're asking for email address in addition.  But that's going by their documentation, so I could very well be wrong.

http://technet.microsoft.com/en-us/library/jj205463.aspx

c)       Once replaced with Shibboleth for Email access. Now user logs to Student portal using their Student Login id, post authentication while clicking on “My Email” will Shibboleth pick the email address from the cookie session and provide the same to Office 365 thus allowing user a SSO experience to access emails?

"My Email" probably leverages a field in your back-channel provisioning(likely mail), but it could try to build an email address for the user using ImmutableID.  This is a question to ask to Microsoft and another potential area of improvement.

Thanks,
Nate.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130605/7eb25ef3/attachment.html