ECP Practical issue

[Peter Schober]

* lalith jayaweera <j_lalith at hotmail.com> [2015-11-04 13:05]:
> but my question is in the authentication block it self, that is, in
> the absence of full UPN from Office 365 during the authentication
> flow, how to mimic it as the email address and authenticate against
> the email attribute in LDAP.

That's one question: You want subjects to authenticate using their
email address (used as unique identifier) but this should also work if
httpd is only provided with a part of the string (the local part)?
I doubt httpd's module have that capability (conditionally adding a
static string to the username provided during HTTP Basic Auth /before/
passing it to a module for processing) but that's definitively not a
Shibboleth question.

> because as per my understanding, only local part of UPN becomes the
> username for the Apache LDAP auth handler in IdP during the
> office365 flow of execution not the full UPN which is the email
> address.

That's a different question: You're saying even if the full email
address is supplied to httpd during HTTP Basic Auth, only a part of
the supplied string becomes REMOTE_USER in httpd? I very much doubt
this (and that would be a bug in httpd or the relevant module), but
again, this has nothing to do whatsoever with Shibboleth.

The Shib project hasn't recommended (or even documented) to use Apache
httpd with the IDP in a long time, and the current IDP (v3) even takes
care of ECP out of the box, using the same auth methods configured for
WebSSO uses.
-peter