ECP Practical issue

[lalith jayaweera]

Hi Peter,
 
Thanks for the reply, my answers inline
 
> Date: Wed, 4 Nov 2015 14:03:51 +0100
> From: peter.schober at univie.ac.at
> To: users at shibboleth.net
> Subject: Re: ECP Practical issue
> 
> * lalith jayaweera <j_lalith at hotmail.com> [2015-11-04 13:05]:
> > but my question is in the authentication block it self, that is, in
> > the absence of full UPN from Office 365 during the authentication
> > flow, how to mimic it as the email address and authenticate against
> > the email attribute in LDAP.
> 
> That's one question: You want subjects to authenticate using their
> email address (used as unique identifier) but this should also work if
> httpd is only provided with a part of the string (the local part)?
> I doubt httpd's module have that capability (conditionally adding a
> static string to the username provided during HTTP Basic Auth /before/
> passing it to a module for processing) but that's definitively not a
> Shibboleth question. Yes do agree, don't think below ldap auth handler capable of massaging the username prior.
> 
> > because as per my understanding, only local part of UPN becomes the
> > username for the Apache LDAP auth handler in IdP during the
> > office365 flow of execution not the full UPN which is the email
> > address.
> 
> That's a different question: You're saying even if the full email
> address is supplied to httpd during HTTP Basic Auth, only a part of
> the supplied string becomes REMOTE_USER in httpd? I very much doubt
> this (and that would be a bug in httpd or the relevant module), but
> again, this has nothing to do whatsoever with Shibboleth. No I am not telling it a httpd bug, because even in the non-webclient auth request the username carry only the local part of UPN (email), I guess that is how Office365 works with ECP in this whole interaction.
> 
> The Shib project hasn't recommended (or even documented) to use Apache
> httpd with the IDP in a long time, and the current IDP (v3) even takes
> care of ECP out of the box, using the same auth methods configured for
> WebSSO uses. I guess all Shibboleth wants is REMOTE_USER populated after the Authentication isn't it?  In general, this UPN issue is a common issue in Office 365 world, for institutions where they cannot change UPN to facilitate above, there are other ways to do via 'Configuring Alternate Login'. My understanding is that option is only with ADFS not with Shibboleth . Lot of above doubts possible not direct Shibboleth questions but I guess Shibboleth is still one piece in the same puzzle and possible someone already experienced above.
  		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151105/313c8eaf/attachment.html>