different assertions generated for WEB and ACTIVE clients [SOLVED]

[Mauro Minella]

Hi,
I finally made it work. The last trick before compiling is to prevent Shibboleth from sending the Transient NameID by removing or commenting the following lines out in attribute-filter.xml:

        <afp:AttributeRule attributeID="transientId">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>

To recap, in order to implement ACTIVE authentication, you should:
- Install the Shibboleth ECP Extension (already included in Shibboelth 2.3.3 or later)
- Enable HTTP Basic authentication in Tomcat
- Provide the ECP entry point on the SP side
- Add SAML2 ECP Profile entry to the Windows Azure AD Relying Party
- Enable ECP extension in WEB.XML
- Update certificate name in BUILD.XML
- Block Shibboleth from sending the Transient NameID
- Restart Apache Tomcat service

To whom it may concern, I collected the results in this playlist http://www.youtube.com/playlist?list=PLzp167WWyvMLpvQeNeurJzbF6yPOeadOS&feature=em-share_playlist_user which includes 6 videos showing how to implement Office 365 federation with Shibboleth, end-to-end.

Mauro