Troubleshooting ECP

[Dan Malone]

We are integrating with our first ECP SP (Office 365) and need some help troubleshooting the IDP side of things.
I know this is not an O365 forum, so I will try to keep my questions to the IDP side of things, but I will accept hints on the O365 configuration as well.
Our web based O365 SAML authentication (non-ECP) is working without issues.

Following is a walk through of what we have done to test, what the IDP logs are showing, our interpretation of the meaning, and some questions at the end.

We have IDP 2.4.2 running on Tomcat and think we have basic authentication configured correctly.
Using a browser, we visit our ECP profile URL ( https://idp-dev.calpoly.edu/idp/profile/SAML2/SOAP/ECP ).
The initial log entry shows the 401 not authorized status that makes the browser prompt for username and password.

    129.65.184.78 - - [26/Nov/2014:06:32:51 -0800] "GET /idp/profile/SAML2/SOAP/ECP HTTP/1.1" 401 951 https://idp-dev.calpoly.edu/idp/profile/SAML2/SOAP/ECP

The logs then show a successful authentication by showing the username and a 500 not found status. We assume the 500 status is because the browser submits a GET request and the profile is expecting a SOAP/ECP POST request.

    129.65.184.78 - omdemo05 at calpoly.edu [26/Nov/2014:06:33:10 -0800] "GET /idp/profile/SAML2/SOAP/ECP HTTP/1.1" 500 255 https://idp-dev.calpoly.edu/idp/profile/SAML2/SOAP/ECP


With the assumption our ECP authentication is working correctly, we added the parameter to the O365 configuration to enable ECP:

    -ActiveLogOnUri https://idp-dev.calpoly.edu/idp/profile/SAML2/SOAP/ECP

After adding this parameter, the web based authentication continues to work consistently and we do notice a difference in behavior with the non-web clients.
When attempting to open a document with the desktop version of MS Word, we see the same 401 not authorized as above, also showing the request is coming from WINWORD.EXE.

    129.65.184.78 - - [26/Nov/2014:06:03:29 -0800] "POST /idp/profile/SAML2/SOAP/ECP HTTP/1.0" 401 951 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.1; WOW64; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; MSOIDCRL 7.250.4556.0; App WINWORD.EXE, 15.0.4667.0, {9317BCB6-314B-442F-A5DA-9BC2BEBC271D})"

Word prompts for username and password and then shows a non-helpful failure message, yet there are no further IDP logs.
We did find it odd that the ECP request was coming from the desktop IP address. Based on our understanding, and the diagram found here ( http://blogs.kent.ac.uk/unseenit/author/ms1/ ), we assumed the ECP request would come from somewhere in the O365 cloud.

Questions/requests:
1. Can someone share their logs to show what a successful ECP authentication looks like.
2. Should the ECP authentication request come from the users desktop or from the O365 cloud?
3. Is there a testshib.org like service for testing ECP?

Thanks,
Dan

-- 
Dan Malone
dmalone at calpoly.edu
Cal Poly State University - San Luis Obispo

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141201/3eb5cee2/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3687 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20141201/3eb5cee2/attachment.bin