Pro & Cons of Shibboleth Authentication for Office 365

[NICHOLAS S ROY]

+1 to everything Scott said.  When I was at U. Iowa tried Shib with Live at EDU and the integration wasn't great because Lync presence relied on WS-Fed, if I recall.

You can provision to O365 using DirSync (effectively a "free" blackbox Forefront Identity Manager 2010 with only two MAs - AD Domain Services local and a cloud MA) or PowerShell scripts, or the DirGraph API (http://community.office365.com/en-us/blogs/office_365_technical_blog/archive/2013/05/06/are-you-a-developer-looking-for-office-365-directory-apis.aspx).

Be warned: DirSync will provision a bunch of cloud attribute values for things like blocked address hashes down to your local AD when you enable it.  It is the only way to sync things like Global Address Lists and Lync info between cloud and on-prem that I'm aware of.

Again, if Lync presence sharing between on-prem and cloud is important to you, ADFS and DirSync is the only way to support that, as far as I know.

Best,

Nick

----- Original Message -----
From: "Scott Cantor" <cantor.2 at osu.edu>
To: "Shib Users" <users at shibboleth.net>
Sent: Friday, May 24, 2013 10:36:39 AM
Subject: RE: Pro & Cons of Shibboleth Authentication for Office 365

> Shibboleth may rely on AD as well, but in this case I see no reasons to use
> Shibboleth rather than ADFS, which gets better support (free for
> schools/universities), is easier to setup, and fully supports Lync clients which
> is currently are supported by Shibboleth.

If you qualify "better support" as "what Microsoft supports in the context of O365", then I can't disagree (and that's hardly surprising). If you're talking straight on product support for ADFS vs. Shibboleth, I'll take that bet any day of the week.

To the OP, I will say that fundamentally if you are more comfortable in Java and XML than with Microsoft's environment, you will find Shibboleth easier than ADFS (and it's much more flexible and open). If not, the opposite will be true.

I don't think the OP would be terribly happy using ADFS as the sole federation infrastructure in his/her environment. If all you need is O365, then I'm sure a better case could be made for it.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net