Office 365 -> ADFS ->Shibboleth iOS problems?

[Patrick Le]

Our ticket with Microsoft (for anyone having the issue) is 116081214540325. Feel free to mention our case for anyone with existing cases open to help coordinate troubleshooting efforts. We'd appreciate if anyone with open Microsoft tickets shoot over their case number as well so we could put a little more pressure on Microsoft to help us figure this one out.

The way our environment is setup, we state the authentication methods we allow within the web.config of the ADFS servers. Forms based auth is at the top of the preferred order. The way I understand it, is if a Microsoft client supports forms based auth, it will try that first. When it does, we tell the ADFS discovery service to auto select Shibboleth as the identity/claims provider. When a client not support forms auth  (like Skype or Apple mail), it then fails through down the list to the next authentication method available (normally username/password or basic auth). Since we don't have any discovery service there, ADFS knows to just auth directly against Active Directory instead of Shib  and handle the auth in a manner the client understands. 

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of users-request at shibboleth.net
Sent: Wednesday, August 17, 2016 6:18 PM
To: users at shibboleth.net
Subject: users Digest, Vol 62, Issue 93

Send users mailing list submissions to
	users at shibboleth.net

To subscribe or unsubscribe via the World Wide Web, visit
	http://shibboleth.net/mailman/listinfo/users
or, via email, send a message with subject or body 'help' to
	users-request at shibboleth.net

You can reach the person managing the list at
	users-owner at shibboleth.net

When replying, please edit your Subject line so it is more specific than "Re: Contents of users digest..."


Today's Topics:

   1. RE: Office 365 -> ADFS ->Shibboleth iOS problems?
      (Eric Kool-Brown)
   2. Re: Office 365 -> ADFS ->Shibboleth iOS problems?
      (Klingenstein, Nate)
   3. Re: Office 365 -> ADFS ->Shibboleth iOS problems? (Cantor, Scott)


----------------------------------------------------------------------

Message: 1
Date: Wed, 17 Aug 2016 22:02:30 +0000
From: Eric Kool-Brown <kool at uw.edu>
To: Shib Users <users at shibboleth.net>
Subject: RE: Office 365 -> ADFS ->Shibboleth iOS problems?
Message-ID:
	<CY1PR08MB1960249CFDA028891140B2BAA5140 at CY1PR08MB1960.namprd08.prod.outlook.com>
	
Content-Type: text/plain; charset="us-ascii"

Hi Scott,

No, I don't know how the Apple mail app works but I presume that it is using the WS-Trust version of ECP or artifact binding. This is similar to how older versions of Outlook worked where the app itself prompts for creds and then sends them as part of session initiation (protected by SSL/TLS of course).

    Eric

> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, 
> Scott
> Sent: Wednesday, August 17, 2016 2:43 PM
> To: users at shibboleth.net
> Subject: Re: Office 365 -> ADFS ->Shibboleth iOS problems?
> 
> On 8/17/16 5:36 PM, Eric Kool-Brown wrote:
> >
> > We are running ADFS 2.0 so I would be surprised if it recognized the 
> > new MS-PKAP header and acted on it, but perhaps this was added via 
> > an
> update.
> 
> Doesn't seem likely any other SAML IdP products would understand it either.
> 
> You mentioned OneDrive, and I seem to recall that it was mentioned as 
> an outlying / non-functional part of the picture when I spoke to 
> Microsoft recently, but the OP seemed to be saying all their apps 
> there weren't working.
> 
> Since we're discussing it, can you explain to me how login from non-MS 
> mail clients (e.g. Apple Mail on iOS) works if you federate with ADFS 
> (with or without Shibboleth)?
> 
> I know with Shibboleth you probably would have to do the ECP proxy 
> thing, but do they actually support this via WS-Trust with ADFS 
> natively to avoid that?
> 
> -- Scott
> --
> To unsubscribe from this list send an email to users- 
> unsubscribe at shibboleth.net


------------------------------

Message: 2
Date: Wed, 17 Aug 2016 22:09:06 +0000
From: "Klingenstein, Nate" <nklingenstein at calstate.edu>
To: Shib Users <users at shibboleth.net>
Subject: Re: Office 365 -> ADFS ->Shibboleth iOS problems?
Message-ID: <7609EF90-1408-4B98-8784-5131C1349701 at calstate.edu>
Content-Type: text/plain; charset="us-ascii"

No, I don't know how the Apple mail app works but I presume that it is using the WS-Trust version of ECP or artifact binding. This is similar to how older versions of Outlook worked where the app itself prompts for creds and then sends them as part of session initiation (protected by SSL/TLS of course).

It was, as far as I could tell, still doing ECP-spoofing here.

The queries come in directly from Microsoft.  Outlook on iPhone worked fine, but Apple Mail didn't work on iPhone or Mac OS X.  We had no issues with a broken ECP except that.

I'm pretty sure it's configurable by IdP name.  Microsoft maintains a mapping of domains to protocols and IdP's.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160817/e7e73df9/attachment-0001.html>

------------------------------

Message: 3
Date: Wed, 17 Aug 2016 22:18:23 +0000
From: "Cantor, Scott" <cantor.2 at osu.edu>
To: "users at shibboleth.net" <users at shibboleth.net>
Subject: Re: Office 365 -> ADFS ->Shibboleth iOS problems?
Message-ID: <6fe19277-ae71-7298-4338-c678617f5770 at osu.edu>
Content-Type: text/plain; charset="Windows-1252"

On 8/17/16 6:02 PM, Eric Kool-Brown wrote:
> Hi Scott,
> 
> No, I don't know how the Apple mail app works but I presume that it is 
> using the WS-Trust version of ECP or artifact binding.

Mail clients wouldn't know how to do that. So they must be proxying the password to Microsoft, and it's exactly like the ECP case, just WS-Trust instead of ECP. I was just curious. People don't seem to mention that MS is getting their passwords in the ADFS case.

It's hard to argue for federation very strongly when the end result is them getting your passwords either way. Unless you manage to block use of mobile mail clients I guess.

-- Scott


------------------------------

Subject: Digest Footer

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

------------------------------

End of users Digest, Vol 62, Issue 93
*************************************