Auto populating j_username using username/password authentication

[Nate Klingenstein]

Chris,

I assure you I would rather give any answer other than this one, but:

SAML has nothing in widespread use in the protocol today that is capable of echoing the entered username.  This is ultimately an artifact of history, down to (very valid) privacy and phishing considerations and the troubled history of discovery interfaces.

Microsoft implemented something that is heavily customized as part of Office 365.  I haven’t seen the implementation reused elsewhere.  I think this bridges into WS-* at Azure AD, but is again not widely supported.

I expect something similar to be implemented widely someday.  Will it be this?  Will it be something else?

GET https://login.microsoftonline.com/common/userrealm/?user=ndk@microsoft.com&api-version=2.1&stsRequest=rQIIAbPSySgpKSi20tcvyC8qSczRy81MLsovzk8ryc_LycxL1UvOz9XLL0rPTAGxioS4BObHnp266Eed_476bTKROu5_VjEqEzZC_wIj4wtGxltMgv5F6Z4p4cVuqSmpRYklmfl5j5h4Q4tTi_zzcipD8rNT8yYx8-Xkp2fmxRcXpcWn5eSXAwWAJhQkJpfEl2QmZ6eW7GJWsTQ2MbYwN0jSTTFPNtY1MU1O0rU0MDPQNUxLMbUwS0yySDVLvcAi8IOF8QAnIwA1&checkForMicrosoftAccount=true

Hopefully someone else has a better answer,
Nate.

> On Feb 25, 2016, at 14:09, Mr. Christopher Bland <chris at fdu.edu> wrote:
> 
> Hi All,
> 
> I have been tasked with authenticating Azure AD (cloud only) accounts and on premise AD accounts with the same domain name (@contoso.com) in Office 365.  At present thanks to the great Microsoft Interop docs I have Office365, AD, and Shibboleth working together.  My plan is to deploy a SP with lazy session so I can detect existing session and forward authenticated users accordingly. For unauthenticated users => collect username using a php form local to the SP => Check to see if they are an AD or Azure AD account using Graph API calls (still working on the Graph API authentication portion) => Redirect on prem AD accounts to Office365 using IDP inititated session.
> 
> Due to the fact that I need to capture the username for my decision based logic I don’t want to prompt the user to enter the username a second time.  So I am trying to figure out how to pass it as part of my IDP initiated session URL.  I looked at previous posts and it looks like this has been done but it is unclear how.
> 
> Also if anyone has solved a problem like the the one I am working with I would appreciate feedback.  At the moment this is a theoretical solution.  I am working on proof of concept.
> 
> -Chris
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net