Office365 ECP broken after shib3 upgrade

[Klingenstein, Nate]

Two signatures in 3, one signature in 2.

 <bean parent="SAML2.ECP" p:encryptAssertions="false" p:signAssertions="true" p:signResponses="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />

https://wiki.shibboleth.net/confluence/display/IDP30/Office+365

> On Oct 17, 2016, at 7:36 PM, Ryan Suarez <ryan.suarez at sheridancollege.ca> wrote:
> 
> Greetings,
> 
> It looks like our Office365 ECP is broken after upgrading from shib2 to shib3.2.1 IdP.  I upgraded by copying over the shib2 config to a clean host and running the shib3 installer.  I thought the issue was shib3 passing an incorrect nameid, but the problem persists after fixing this.
> 
> Login to the web portal works but logging in through ECP (eg. Outlook client) does not.  I have a microsoft premier support call open but I’m also reaching out here, in case anyone has come across this.  The error from outlook 2013 is:
> “Outlook cannot log on.  Verify you are connected to the network and are using the proper server and mailbox name.  The connection to Microsoft Exchange is unavailable.  Outlook must be online or connected to complete this action.”
> 
> Both the shib2 and shib3 nodes passed this ECP test:
> https://blogs.kent.ac.uk/unseenit/simple-shibboleth-ecp-test
> 
> This is the ECP response from shib2:
> http://pastebin.ca/3730035
> 
> This is the ECP response from shib3:
> http://pastebin.ca/3730036
> 
> I can switch back to shib2 and confirm it works, and switch forward to shib3 and confirm it’s broken.  Does anyone have any insight?
> 
> Regards,
> Ryan
> 
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net