off-topic help for Office 365

[Michael O Holstein]

I can confirm that O365 fully works with IDPv3, including ECP and all of the Office Online stuff (including Skype, although you have to get ADAL enabled through a MSConnect program because it's not GA yet).


We have this written up in anticipation of a talk at OHECC (we host it this year) but not quite ready yet .. but here is the O365 side highlights :


Here is the link to the connect program for ADAL in SfB : http://aka.ms/PublicPreview


You should open a PSS ticket concurrent with that form so your account manager can track the progress .. it will take a couple weeks (about 3 for us, did it Dec of 2015).


Here is what you have to do in the tenant :

(this does not actually break anything, you can easily move it back to ADFS .. but that said, I would try this in your DEV tenant first, YMMV, batteries not included).

-remove existing federation
Convert-MsolDomainToStandard -DomainName whtever.edu -SkipUserConversion

-add new one
NOTE: below, the $cert had to be created thusly:
openssl x509 -in idp-signing.crt -outform der |openssl enc -base64 |tr -d '\n'

-below is pasted into msol powershell
$dom = "whatever.edu"
$url = "https://whatever.edu/idp/profile/SAML2/POST/SSO"
$ecpUrl = "https://whatever.edu/idp/profile/SAML2/SOAP/ECP"
$uri = "https://whatever.edu/idp/shibboleth"
$logouturl = "https://whatever.edu/path/to/stuff"
$cert = "DER_ENCODED_CERT_GOES_HERE"

-this actually does the dirty .. should produce no output or errors.
Set-MsolDomainAuthentication -DomainName $dom -FederationBrandName $dom -Authentication Federated  -PassiveLogOnUri $url -SigningCertificate $cert -IssuerUri $uri -ActiveLogOnUri $ecpUrl -LogOffUri $logouturl -PreferredAuthenticationProtocol SAMLP


Regards,


Michael Holstein

Cleveland State University


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Paul Hethmon <paul.hethmon at clareitysecurity.com>
Sent: Wednesday, February 17, 2016 4:39 PM
To: Shibboleth Users
Subject: Re: off-topic help for Office 365


On Feb 17, 2016, at 4:14 PM, David Gersic <dgersic at niu.edu<mailto:dgersic at niu.edu>> wrote:

I know a little bit about Office365, and a little bit about Shib. Does "had it working" mean that you successfully federated your Office365 tenant with your local Shibboleth IdP? No other things like ADFS being involved?

No ADFS involved. Our primary product here at Clareity is an IAM system. So I federated to my IAM system via Shibboleth/SAML.


If so, does "had" mean that you ran the PowerShell commands to un-federate your tenant and have being using Office365's native authentication? If so, did that un-federate actually complete successfully? If it didn't, then you may be hitting an error trying to federate a tenant that thinks that it is already federated.

This actually bit me to start, but I unfederated it. To really make sure, I removed that original domain from Office365 entirely and added the new one. I also have the "onmicrosoft.com<http://onmicrosoft.com>" domain set as the default since you can't federate a domain that is the default in O365.



-----
Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160217/30347e3b/attachment-0001.html>