Shibboleth ECP and Office 365

[Jonathan L Ocab]

I apologize for any incoherence because I am not a Shibboleth expert by any means. 

So I configured our existing Shibboleth instance (albeit dev environment) with Office 365. The typical SP integration was very straight forward in order to get the passive authentication working for Office 365 OWA (O365 OWA bounces to our Shibboleth+CAS instance and back to O365 on success), and it was just like integrating any other non-InCommon SP.

But the issue I’m having is with the ECP endpoint for the ‘active’ clients (e.g. Microsoft Outlook for Win/Mac). I configured everything based on their white paper (https://www.microsoft.com/en-us/download/details.aspx?id=35464) and we couldn’t figure why authentications were failing until we enabled logging of the auth headers in tomcat’s extended access logs and noticed that the UPN was being trimmed down to just username on the basic auth (e.g. someuser at somedomain.com comes in as just ‘someuser’).

When I adjusted the ldap filter to check on samaccountname as opposed to userPrincipalName, authentications to the ECP endpoint began working.

My concern with this is that Microsoft indicated to us that they send the full userprincipalname. We did everything to log including wiresharking the traffic and seeing only the username portion of the UPN being sent in the traffic dump. I’ve contacted MS support regarding this issue and they claim we’re doing something to the UPN.

Am I missing something in the IDP and ECP configuration? I could just leave it be and just filter on samaccountname since everything is working. But are we actually receiving the full UPN and somehow munging up the UPN? If I curl the ECP endpoint with a UPN string in the username field, it comes through correctly (I see it in the extended access logs). 

Thanks.

---
Jonathan Ocab | jocab at ucr.edu
Infrastructure Security Analyst
Computing and Communications
University of California, Riverside