Apparent inconsistencies in the Shibboleth wiki concerning persistent NameIDs for federating a Shibboleth IDP with Microsoft Azure

[Michael A Grady]

> On Mar 31, 2016, at 7:40 PM, Florian Lengyel <Florian.Lengyel at cuny.edu> wrote:
> 
> 

> I think this could be mentioned in the documentation. I'm doing what https://wiki.shibboleth.net/confluence/display/IDP30/Office+365  and Michael A. Grady suggest, and shibboleth is sending the correct SAML assertions (Issuer, IDPEmail and NameID) that Azure presumably expects). The login failure may be a question of what was synchronized with Azure--this is in the hands of another group here.
> 
> It will be gratifying for CUNY, the largest urban public university in the United States, to adopt Shibboleth and to work with other SPs.
> 


So I didn't earlier list the full Relying Party overrides, from the default v3 settings, for O365. Mostly because I can't say for 100% certain that all of these overrides are necessary. I was working with a client that had an existing working config with O365 (including using ECP), and no way to test the v3 settings (no O365 test domain) without impacting Production, so the safest bet to make was to match the settings they had in their v2 config. It's possible that your error could stem from not matching one of these, including whether the SHA1 (default in v2) or SHA256 signing algorithm (default in v3) is used. (There are web pages that suggest that O365 still requires SHA1.) So you could try these (if you don't already have them), and see if any help. And maybe you also have the opportunity to test exactly which of these are actually really required today.

What I can say for certain is that the below settings *do* work with O365.


	    <!--
	        Azure AD / Office 365
	        Relying Party Configuration
	    -->
        <bean parent="RelyingPartyByName"
              c:relyingPartyIds="urn:federation:MicrosoftOnline">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.ECP"
                          p:encryptAssertions="false"
                          p:signAssertions="true"
                          p:signResponses="false"
                          p:securityConfiguration-ref="SHA1SecurityConfig"
                          p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
                    <bean parent="SAML2.SSO"
                          p:encryptAssertions="false"
                          p:signAssertions="true"
                          p:signResponses="false"
                          p:securityConfiguration-ref="SHA1SecurityConfig"
                          p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
                    <bean parent="SAML2.Logout" p:securityConfiguration-ref="SHA1SecurityConfig" />
                </list>
            </property>
        </bean>

--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20160331/578042fe/attachment-0001.sig>