ECP and Office365

[John Morrison]

Hello!


With the use of ECP and microsoft outlook rich clients, we have an issue
when having our UPN or EPPN scoped attribute as the email address
instead of the uid at domain correct format.

As when setting up the outlook mail client, it hits the ECP protocol and
takes the first part of the UPN "firstname.lastname.1111", being the
email address firstname.lastname.1111 at domain.x  

Is there a way to rewrite this in the apache config or in the auth flows
on ECP to somehow search out the correct user based on this part, with
some LDAP wild card instead?

We have used OAuth being turned on the office365 tenant, which moves
away from ECP and uses SAML instead and works well. But this only solves
for microsoft clients. And not thunderbird and other native clients.

Our local on-prem UPN is of the right format. But the office guys want
to use mailaddress as the UPN.

Anyone had success with office365 and ECP with version 3 IdP? and all
the other mail clients trying to authenticate.

We have got the Office working well with SAML only for now. Our ECP is
protected via apache ldap location config.


<Location /idp/profile/SAML2/SOAP/ECP>

#TESTING
#AuthLDAPRemoteUserAttribute eduPersonPrincipalName
#RequestHeader  set X-App2-Remote-User%{AUTHENTICATE_eduPersonPrincipalName}e


AuthType Basic
AuthName "Username/Password"
AuthBasicProvider ldap
AuthLDAPUrl
"ldaps://dc.xx.xx.xx:636/OU=O365,OU=xx,OU=xx,OU=xx,DC=xx,DC=xx,DC=xx?sAMAccountName?sub?(objectClass=*)"NONE
AuthLDAPBindPassword "x"
##AuthzLDAPAuthoritative OFF
Require valid-user
   
   # TESTING 
   # Adding Information into headers
   # RewriteCond %{REMOTE_USER} (.+)
   # RewriteRule .* - [E=RU:%{REMOTE_USER}]
   # RequestHeader set X-App2-Remote-User %{RU}e

</Location>


/John