Microsoft Azure + AD FS 3 + Shibboleth IdP v3

[Leif Johansson]

On 2016-02-23 13:29, David Sanchez Herrero wrote:
> Hello all,
> 
> We are working on a scenario to federate our Microsoft Domain with the
> Microsoft Cloud using AD FS 3, but making AD FS to delegate passive
> authentication (web) to the Shiboleth IdP v3. The authentication flow
> should be:
> 
> 1) Open portal.office.com <http://portal.office.com> (Office365) in a
> web browser and type an email address from our domain.
> 2) The Microsoft cloud redirects us to our AD FS server, which redirects
> us again to the Shibboleth IdP v3 login page.
> 3) When IdP v3 authenticates the user, it returns the control to AD FS,
> which sends the user validation to Office365.
> 
> We are stuck between points 2 and 3. The IdP succesfully authenticates
> the users from our Domain Controller (LDAP Connector), but something is
> wrong (we suppose) when sending the validation information back to AD
> FS. We have activated various DEBUG flags in Shibboleth, but it didn't
> help us so much to identify the problem.

I order to do this you need to configure a proxy SP in front of your
shib IDP and configure your ADFS to trust that proxy SP. I'm not sure
if shib v3 supports SAML authentication (i.e has a proxy module) but
it should not be impossible.

In any case its not just a question of a redirect

> 
> We have searched A LOT for documentation about this deploying scenario,
> but no success. All the usefull information is for AD FS 2 and IdP v2,
> but no updated documentation for AD FS 3 and IdP v3. Do you know if this
> deploying scenario using both v3 is possible? Any updated documentation
> source to check?
> 
> Attached to this mail are the IdP log, and some relevant configuration
> files. Could you please check if something is wrong? If you need any
> additional files, please, let me know.
> 
> Thanks in advance, David.
> 
>