Office 365 -> ADFS ->Shibboleth iOS problems?

[Klingenstein, Nate]

> People don't seem to mention that MS is getting their passwords in the ADFS case.

I -think- this is the smoking powershell.  See "Configuring a Domain":

https://msdn.microsoft.com/en-us/library/azure/dn641269.aspx

It's beyond finicky, but there's a bit for setting the protocol, and even modest documentation of it.  This is, as far as I can tell, still true, as long as you can mandate use of Outlook.  Apple iOS knows about Exchange, but I don't.

You must run use “$ecpUrl = “https://WS2012R2-0.contoso.com/PAOS“” only if you set up an ECP extension for your identity provider. Exchange Online clients, excluding Outlook Web Application (OWA), rely on a POST based active end point. If your SAML 2.0 STS implements an active end point similar to Shibboleth’s ECP implementation of an active end point it may be possible for these rich clients to interact with the Exchange Online service.

> Unless you manage to block use of mobile mail clients I guess.

If wishes were horses...