Office 365 -> ADFS ->Shibboleth iOS problems?

[Klingenstein, Nate]

> That's still all about using SAML. I'm talking about what happens when
> there's no SAML protocol used. Standard WS-* like they started with back
> in the day.

It's WS-Signin, whatever that is, by default in the front channel.  I don't know what the default is in the back channel, but I'm sure it depends on the application.

All I know definitively is that, with broken ECP with Office 365, Apple Mail was dead in the water and Outlook on the same clients was fine.  I presume it was SMTP and POP3 as a protocol, but there's obviously no SMTP or POP3 traffic that comes in to the IdP.

> I do know Apple Mail supports Exchange, yes, but there's still the
> authentication step to deal with. Consider any other mail client you
> like that doesn't do Exchange/ActiveSync.

Apple Mail was the only one that broke here when ECP broke, which really surprised me.  This was unfortunately empirically determined a week or two ago.

> I think the answer is clearly that they're proxying passwords to a
> WS-Trust ADFS endpoint, but I'd just be interested in confirming that.

Whether it's WS-Trust or SAML or waffles seems irrelevant to me.  I care about what lands on the IdP and what the client supports.  I literally don't control or see any intermediate protocols.  The ultimate queries here were definitely ECP requests coming directly from Microsoft.