ECP and Office365

[Cantor, Scott]

> With the use of ECP and microsoft outlook rich clients, we have an issue
> when having our UPN or EPPN scoped attribute as the email address
> instead of the uid at domain correct format.

Those are the same format, so I can't quite understand your point there.

> Is there a way to rewrite this in the apache config or in the auth flows
> on ECP to somehow search out the correct user based on this part, with
> some LDAP wild card instead?

If you need to handle different kinds of authentication lookup, that depends on how you're doing authentication, but with LDAP you have whatever capability you want, really, you can use combinations of search filters and things like that. You need to either leverage the subject canonicalization features after authentication to get the username back out normalized into a consistent form or you would have to accomodate different types of username formats in the attribute resolver.

> We have got the Office working well with SAML only for now. Our ECP is
> protected via apache ldap location config.

Well, my advice is to not to do that and use the IdP directly, I guess, but absent that it's not really an issue for me to weigh in on since it's not the IdP doing the authentication.
 
-- Scott