Pro & Cons of Shibboleth Authentication for Office 365

[Hodgdon, Paul]

I am also looking for clarity on this.  If the user is just using outlook.com (thin app) does that mean Lync will still work  with Shibboleth and if they use the client then Shibboleth will not work.

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of solution79
Sent: Sunday, May 26, 2013 8:19 PM
To: 'Shib Users'
Subject: RE: Pro & Cons of Shibboleth Authentication for Office 365

Hello Nick,

As per your last statement: 

if Lync presence sharing between on-prem and cloud is important to you, ADFS and DirSync is the only way to support that, as far as I know.

We are planning to use LYNC but only purely LYNC online as all the users are on live at edu and will be migrated to Office 365. In such a case can we still use Shibboleth to authenticate?
I guess yes, but many in the past have raised concerns of Shibboleth cannot be used if you are using LYNC, thus looking for a clarity.

Also Shibboleth will be used only for authentication, does that means that provisioning of ids has to be done using Dirsync which in turn will talk to local AD?
Or within Shibboleth we have a counterpart of Dirsync that takes to the LDAP of Shibboleth?

Please respond at the earliest.

Dematri


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of NICHOLAS S ROY
Sent: Saturday, May 25, 2013 1:01 AM
To: Shib Users
Subject: Re: Pro & Cons of Shibboleth Authentication for Office 365

+1 to everything Scott said.  When I was at U. Iowa tried Shib with 
+Live at EDU
and the integration wasn't great because Lync presence relied on WS-Fed, if I recall.

You can provision to O365 using DirSync (effectively a "free" blackbox Forefront Identity Manager 2010 with only two MAs - AD Domain Services local and a cloud MA) or PowerShell scripts, or the DirGraph API (http://community.office365.com/en-us/blogs/office_365_technical_blog/archiv
e/2013/05/06/are-you-a-developer-looking-for-office-365-directory-apis.aspx)
.

Be warned: DirSync will provision a bunch of cloud attribute values for things like blocked address hashes down to your local AD when you enable it.
It is the only way to sync things like Global Address Lists and Lync info between cloud and on-prem that I'm aware of.

Again, if Lync presence sharing between on-prem and cloud is important to you, ADFS and DirSync is the only way to support that, as far as I know.

Best,

Nick

----- Original Message -----
From: "Scott Cantor" <cantor.2 at osu.edu>
To: "Shib Users" <users at shibboleth.net>
Sent: Friday, May 24, 2013 10:36:39 AM
Subject: RE: Pro & Cons of Shibboleth Authentication for Office 365

> Shibboleth may rely on AD as well, but in this case I see no reasons 
> to use Shibboleth rather than ADFS, which gets better support (free 
> for schools/universities), is easier to setup, and fully supports Lync 
> clients which is currently are supported by Shibboleth.

If you qualify "better support" as "what Microsoft supports in the context of O365", then I can't disagree (and that's hardly surprising). If you're talking straight on product support for ADFS vs. Shibboleth, I'll take that bet any day of the week.

To the OP, I will say that fundamentally if you are more comfortable in Java and XML than with Microsoft's environment, you will find Shibboleth easier than ADFS (and it's much more flexible and open). If not, the opposite will be true.

I don't think the OP would be terribly happy using ADFS as the sole federation infrastructure in his/her environment. If all you need is O365, then I'm sure a better case could be made for it.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net