Office 365 and Shibboleth integration

[Rob Gorrell]

>
> I am getting close. What you are using for the FederationMetadataUrl ?
>
>
I'm not.... the o365 metadata is stored in a FilesystemMetadataProvider...

    <!-- Azure for Office 365 -->
      <metadata:MetadataProvider id="AzureLocal"
xsi:type="FilesystemMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata"

metadataFile="/opt/shibboleth-idp/metadata/azure-metadata.xml">
         <metadata:MetadataFilter xsi:type="ChainingFilter"
xmlns="urn:mace:shibboleth:2.0:metadata">
            <metadata:MetadataFilter xsi:type="EntityRoleWhiteList"
xmlns="urn:mace:shibboleth:2.0:metadata">

<metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole>
            </metadata:MetadataFilter>
         </metadata:MetadataFilter>
      </metadata:MetadataProvider>


>
> Would you mind sharing how you are releasing attributes? In my
> idp-process.log i get:
>

from my attribute-filter.xml...

  <!-- Attribute Filter Policy for Windows Azure AD -->
   <afp:AttributeFilterPolicy id="PolicyForWindowsAzureAD">
      <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="urn:federation:MicrosoftOnline" />
         <!-- Release userPrincipalName as Windows Azure AD User ID -->
      <afp:AttributeRule attributeID="UserId">
          <afp:PermitValueRule xsi:type="basic:ANY"/>
      </afp:AttributeRule>
         <!-- Release Immutable ID to Windows Azure AD -->
      <afp:AttributeRule attributeID="ImmutableID">
          <afp:PermitValueRule xsi:type="basic:ANY"/>
      </afp:AttributeRule>
         <!-- Note: it is not recommended to send transientId to Windows
Azure AD -->
      <afp:AttributeRule attributeID="transientId">
          <afp:DenyValueRule xsi:type="basic:ANY"/>
      </afp:AttributeRule>
   </afp:AttributeFilterPolicy>



-- 
Robert W. Gorrell
Systems Architect, Identity and Access Management
University of NC at Greensboro
336-334-5954
PGP Key ID B36DB0CA
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140819/d79102b6/attachment.html