O365 vulnerability article analysis

[O'Dowd, Josh]

Can you guys chime in on this article[1].  I am looking for clarity of the problem, because the author didn't seem qualified to describe it.  Also I am looking for best practice to avoid such a scenario, specifically from an IdP administrator's perspective.  Not to mention that our campus is in the planning stages for an Office365 integration with our IdP.

Thanks for your time.

Josh O'Dowd
Software Systems Engineer
Central IT, University of Montana

[1] https://threatpost.com/office-365-vulnerability-exposed-any-federated-account/117716/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160502/d0aee8bd/attachment.html>