Pro & Cons of Shibboleth Authentication for Office 365

[solution79]

Hello Nick,

As per your last statement: 

if Lync presence sharing between on-prem and cloud is important to you, ADFS
and DirSync is the only way to support that, as far as I know.

We are planning to use LYNC but only purely LYNC online as all the users are
on live at edu and will be migrated to Office 365. In such a case can we still
use Shibboleth to authenticate?
I guess yes, but many in the past have raised concerns of Shibboleth cannot
be used if you are using LYNC, thus looking for a clarity.

Also Shibboleth will be used only for authentication, does that means that
provisioning of ids has to be done using Dirsync which in turn will talk to
local AD?
Or within Shibboleth we have a counterpart of Dirsync that takes to the LDAP
of Shibboleth?

Please respond at the earliest.

Dematri


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of NICHOLAS S ROY
Sent: Saturday, May 25, 2013 1:01 AM
To: Shib Users
Subject: Re: Pro & Cons of Shibboleth Authentication for Office 365

+1 to everything Scott said.  When I was at U. Iowa tried Shib with Live at EDU
and the integration wasn't great because Lync presence relied on WS-Fed, if
I recall.

You can provision to O365 using DirSync (effectively a "free" blackbox
Forefront Identity Manager 2010 with only two MAs - AD Domain Services local
and a cloud MA) or PowerShell scripts, or the DirGraph API
(http://community.office365.com/en-us/blogs/office_365_technical_blog/archiv
e/2013/05/06/are-you-a-developer-looking-for-office-365-directory-apis.aspx)
.

Be warned: DirSync will provision a bunch of cloud attribute values for
things like blocked address hashes down to your local AD when you enable it.
It is the only way to sync things like Global Address Lists and Lync info
between cloud and on-prem that I'm aware of.

Again, if Lync presence sharing between on-prem and cloud is important to
you, ADFS and DirSync is the only way to support that, as far as I know.

Best,

Nick

----- Original Message -----
From: "Scott Cantor" <cantor.2 at osu.edu>
To: "Shib Users" <users at shibboleth.net>
Sent: Friday, May 24, 2013 10:36:39 AM
Subject: RE: Pro & Cons of Shibboleth Authentication for Office 365

> Shibboleth may rely on AD as well, but in this case I see no reasons 
> to use Shibboleth rather than ADFS, which gets better support (free 
> for schools/universities), is easier to setup, and fully supports Lync 
> clients which is currently are supported by Shibboleth.

If you qualify "better support" as "what Microsoft supports in the context
of O365", then I can't disagree (and that's hardly surprising). If you're
talking straight on product support for ADFS vs. Shibboleth, I'll take that
bet any day of the week.

To the OP, I will say that fundamentally if you are more comfortable in Java
and XML than with Microsoft's environment, you will find Shibboleth easier
than ADFS (and it's much more flexible and open). If not, the opposite will
be true.

I don't think the OP would be terribly happy using ADFS as the sole
federation infrastructure in his/her environment. If all you need is O365,
then I'm sure a better case could be made for it.

-- Scott


--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net