Shibboleth for Office 365 (Authentication decision)

[Nate Klingenstein]

Dematri,

Office365 wants an "ImmutableID" for your users.  You will need to decide what identifier is most immutable, unreassigned, persistent, etc. and send it.  It needs to, again, match the back-channel provisioning.

May I understand that every id placed in the LDAP - SUN Enterprise need to have an Immutable ID field as well.

It needs to have some unique identifier that matches the semantics and format of Immutable ID.  The IdP can map an arbitrary attribute from your LDAP directory to ImmutableID on the wire, as shown in the example in the Microsoft documentation.

Which make me understand that I need the AD object GUID, but how can I derived that as I am using LDAP – SUN Enterprise?

You might use "uid" or something similar instead.


1)      clicking “My Email” will route the request to Office365.

2)      which in turn will route the request back to Shibboleth IDP and here the browser will provide the session cookie that would authenticate to Shibboleth.

3)      Post authentication, Shibboleth should provide the immutable id details to ADFS and thus allowing the user to log to Office 365 with SSO experience.

Is the process flow correct?

Typically, yes.  The user will have to authenticate if they haven't already.

New Question:
Microsoft Article suggest - Install Windows PowerShell for single sign-on with Shibboleth
Ref: http://technet.microsoft.com/en-us/library/jj205464.aspx

Do we need to install the Windows Azure Active Directory Module on the Shibboleth server or it be any Windows Based server?

This is really a question for Microsoft but my understanding is that it expects to run in Windows Server on a trusted machine.

Thanks,
Nate.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130606/41650ed7/attachment-0001.html