Office365 ECP broken after shib3 upgrade

[Ryan Suarez]

Two signatures in 3, one signature in 2.

Ah, looks like I was missing the signResponses=never bit:


    <rp:RelyingParty id="urn:federation:MicrosoftOnline"

                      provider="http://myidp.mydomain.ca"

                      defaultSigningCredentialRef="IdPCredential"

                      defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">

       <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"

                                signAssertions="conditional"

                                encryptAssertions="never"

                                encryptNameIds="never" />

       <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile"

                                signAssertions="conditional"

                                encryptAssertions="never"

                                signResponses="never"

                                encryptNameIds="never" />

    </rp:RelyingParty>

I’ll need to do more testing but it seems to work now, thanks!

Sorry for just dispatching the quick'n'ugly.  It looked like a production switchover issue to me, so I wanted to get you a quick response.
For what it's worth, I haven't encountered that specific message nor that behavior.  A random site of which I know once had the ECP endpoint out entirely and Microsoft Exchange apparently worked fine on most or all devices, ironically.  Apple Mail bricked.  The experiment was not repeated.

I appreciate the quick response.  It was a production change and I had to roll back to shib2.  The problem was that it worked during my dev/qa testing.  I’d confirm the client works in shib2 and switch to shib3 and see that it still worked.  Is the Microsoft proxy caching credentials?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161018/b91dd7ce/attachment-0001.html>