Session Logout link

[Rob Gorrell]

>
> Secondly, about the link FederationMetaDataUrl. I understand that it has
> nothing to do (for this scenario at least) after the discussion had with
> Rob. May be my understanding was wrong. I thought that SP needs a metadata
> to process the flow and vice versa. But here, only our IdP needs metadata
> file.
>

To be correct, the SP (O365) does need metadata, it just doesn't get it
from a file or URL... but rather by you 'uploading' it using Powershell
(Set-MsolDomainAuthentication cmdlet to be exact... the params you're
supplying with this are in fact telling the SP about the IdPs metadata).


And yes, I agree with Scott's sentiments... I was struggling as well to
understand how anything you did to the ADFS server mattered. If you
configured the SP to use ADFS, those settings were likely still plugged
into the domain, irregardless of you uninstalling/rebooting/doing whatever
to the ADFS server. IdP and SP configurations happen separately, and my
guess is you still had ADFS settings implanted into your O365 domain that
was causing problems.

And just to be clear about what I mean and I'm no expert on the matter, but
despite being both ways of "federating" with O365, there is little to no
parity in how you configure ADFS vs SAML... and you will find many of the
configuration options and powershell cmdlets that do this work aren't
shared between the two approaches. This is what I meant when I cautioned
you that unless otherwise specifically stated, Microsoft is assuming ADFS
when talking about federating and that has no crossover to the SAML world.

-Rob



-- 
Robert W. Gorrell
Systems Architect, Identity and Access Management
University of NC at Greensboro
336-334-5954
PGP Key ID B36DB0CA
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140820/3c860177/attachment.html