off-topic help for Office 365

[Paul Hethmon]

On Feb 17, 2016, at 2:53 PM, Rob Gorrell <rwgorrel at uncg.edu<mailto:rwgorrel at uncg.edu>> wrote:



Without commenting on how clueless MS support is, they are asking me to try a CA signed certificate for the SAML signing certificate (instead of the normal self-signed cert created at installation). So some questions in case someone else has had to bang their head against the O365 wall:

I know literally zero about Office 365, so I have no idea how their trust works and what they really require.  Do you supply a metadata XML document?  Do you upload a key + other info to a mgmt UI on the MS side?

no metadata XML, you upload a 1. domain, 2. url (binding), 3. ecp url (binding), 4. uri (entityID), 5. logout url, and 6. base64 encoded x509 cert. to my knowledge, O365 will only do signing, no encryption of the assertion.


Yea, it’s ugly, full details as documented by MS:  https://msdn.microsoft.com/en-us/library/azure/jj205457.aspx

You use a Windows PowerShell command to tell Azure/Office365 to do SAML. There is no management interface to use. Then you get oh so friendly and useful error messages like this:

PS C:\Users\Administrator\Desktop> Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $dom -Authentication Federated  -PassiveLogOnUri $url -SigningCertificate $cert -IssuerUri $uri -ActiveLogOnUri $ecpUrl -LogOffUri $logouturl -PreferredAuthenticationProtocol SAMLP
Set-MsolDomainAuthentication : Unable to complete this action. Try again later.
At line:1 char:29
+ Set-MsolDomainAuthentication <<<<  -DomainName $dom -FederationBrandName $dom -Authentication Federated  -PassiveLogOnUri $url -SigningCertificate $cert -IssuerUri $uri -ActiveLogOnUri $ecpUrl -LogOffUri $logouturl -PreferredAuthenticationProtocol SAMLP
    + CategoryInfo          : OperationStopped: (:) [Set-MsolDomainAuthentication], MicrosoftOnlineException
    + FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.InternalServiceException,Microsoft.Online.Administration.Automation.SetDomainAuthentication

At this point, you supply MS support with useless information as they are apparently unable or unwilling to look into their own systems to find a real cause.

Paul

-----
Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160217/01b761a9/attachment.html>