ECP and Office365

[Cantor, Scott]

On 12/16/16, 10:35 AM, "users on behalf of John Morrison" <users-bounces at shibboleth.net on behalf of john.morrison at uadm.uu.se> wrote:

> How I would search/auth a user via uid=firstname.lastname would be tricky to correct if coming from the ECP way.

The IdP does not have support for doing an LDAP lookup *before* authentication, because once you do that, you might as well just change the search filter used during LDAP authn in the first place. That generally works fine. I handle 4-5 different kinds of input IDs that way.

On the back side, it has subject canonicalization features to normalize the results back down to a single form to help with other aspects of the system. But that's after login, not before.

> So this is the deal breaker to now use ADFS instead, for Office365.

There is IMHO not much point to federating with Shibboleth or ADFS because they get your password regardless from all these mail clients. At that point, seems like a giant waste of time to me, unless you're going to do multi-factor or something like that.

I used to think the mail proxy thing was specific to use of SAML but since they use it if you deploy ADFS also (not ECP, but same approach), my conclusion is "oh well, this is a waste of time". But that's just me. We're facing the same decision at OSU and my view is we should just sync passwords and forget the whole mess. I'm hearing we'll be doing ADFS, which strikes me as the obviously dumbest option of the three.

There are plenty of sites that have made the ECP proxy work, but I'm not one of them, so not much I can say about it other than the username format really is an LDAP problem, nothing that should cause angst over use of ECP.

-- Scott