Office 365 -> ADFS ->Shibboleth iOS problems?

[Patrick Le]

Does anyone Federate their office 365 environment with ADFS but treat ADFS as a relying party to Shibboleth? If so, have you experienced any issues with IOS app authentication in the last week with Office apps (Word, Excel, PowerPoint, etc.).

We've been seeing some issues since Thursday when Microsoft released updates to their IOS apps. When Shib gets the auth request from ADFS, Shib throws an error:

14:24:29.750 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:400] - Error decoding authentication request message
org.opensaml.ws.message.decoder.MessageDecodingException: No SAMLRequest or SAMLResponse query path parameter, invalid SAML 2 HTTP Redirect message
        at org.opensaml.saml2.binding.decoding.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:98) ~[opensaml-2.6.0.jar:na]
        at org.opensaml.ws.message.decoder.BaseMessageDecoder.decode(BaseMessageDecoder.java:79) ~[openws-1.5.0.jar:na]
        at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:70) ~[opensaml-2.6.0.jar:na]


We've spent the last three days with Microsoft support and have not gotten anywhere with them. We tell them we're missing the query path from ADFS to return the auth request to but they keep telling auth the saml request is the same between both old and new versions. Funny thing is, when we try a device with the previous app versions prior to Thursday, authentication works fine. Yet they still insist that nothing within the authentication stack was changed on the app side even though there's clearly a difference in user experience.

Just seeing if anyone with a similar setup is seeing the same things and if you discovered a workaround.

Thanks

Patrick
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160817/3634f634/attachment.html>