ECP Practical issue

[Peter Schober]

* lalith jayaweera <j_lalith at hotmail.com> [2015-11-05 01:34]:
> Thanks for the reply, my answers inline

At least insert two line breaks before slapping your replies at the
end of my own text.  (I've done that in my reply in order to make it
legible.) Email is not that hard.

> > From: peter.schober at univie.ac.at
> > That's a different question: You're saying even if the full email
> > address is supplied to httpd during HTTP Basic Auth, only a part of
> > the supplied string becomes REMOTE_USER in httpd? I very much doubt
> > this (and that would be a bug in httpd or the relevant module), but
> > again, this has nothing to do whatsoever with Shibboleth.
> 
> No I am not telling it a httpd bug, because even in the
> non-webclient auth request the username carry only the local part of
> UPN (email), I guess that is how Office365 works with ECP in this
> whole interaction.

I don't understand any of that due to total lack of technical details.
Let's consider your Shibboleth IDP (including Apache httpd in front,
for now) a black box -- what is the input into that box and what is
the expeceted vs. the observed output?
An auth request will usually never carry a username or email address.
If OTOH you are talking about the SAML Reponse that goes out to the
SAML SP then that's fully configurable in your Shibboleth IDP.
As long as httpd gives you something unique to look up data on a
subject / username you can tune, modify, add, remove, etc. that data
in your IDP and release whatever part you want to the SAML SP.

> > The Shib project hasn't recommended (or even documented) to use Apache
> > httpd with the IDP in a long time, and the current IDP (v3) even takes
> > care of ECP out of the box, using the same auth methods configured for
> > WebSSO uses.
>
> I guess all Shibboleth wants is REMOTE_USER populated after the
> Authentication isn't it?
> In general, this UPN issue is a common issue in Office 365 world,
> for institutions where they cannot change UPN to facilitate above,
> there are other ways to do via 'Configuring Alternate Login'.

Sorry, see above. I don't know what that means ("this UPN issue",
"change UPN to facilitate above", etc.) and what specifically you're
asking.
-peter