Office 365 App Registration Strange issue on Mac

[Cantor, Scott]

On 8/2/17, 8:27 PM, "users on behalf of Lalith Jayaweera" <users-bounces at shibboleth.net on behalf of ljayaweera at gmail.com> wrote:

> Don't you think this issue is specific to IdP 3.3.x? Or in other words it should also fail on IdP 2.4.x if the request is malformed.

The bug is almost certainly in the client. The result of the bug is dependent on the the state management architecture, and how the application framework deals with improper access, replay, stale requests, and a variety of other things. It works how it works, and buggy clients can break it in all sorts of ways. After lots of tracing and packet analysis, it's likely that the cause would be found, and the end result would be that the client was broken and there isn't really anything we could likely do about it anyway.

> On another note, if we promote IdP 3.3.x to production this feature (Office 365 product activation) will fail on Mac, 

I have no experience with Office 365, but if others do, I guess they could tell if they're having the same issue.

> As a side note, what I am trying is, when the office 365 software downloaded, am try to activate it, in this process, it asks to enter
> the email address and then it does the discovery and goes to the CAS login screen, all these happening(browser rendering)
> within their UI controller,

Did you try it without CAS? I don't think that's related, but if it were, that's not really anything we support, and it's possible that the client bug involves it dropping a cookie during the handoff between the systems.

> Is there any way to find the difference in these two versions and find a way thru for IdP V 3?

The difference is they are completely different pieces of software with virtually nothing in common in the layers involved here. I have no way through to give you, unless it turns out that the use of an unsupported authentication module turns out to be involved. That is certainly the first thing I would check to at least rule it out.

> Error below..............................

Your problem is almost certainly with cookies, but there is nobody else who can trace and diagnose it. You would have to trace all of the interactions and look for a mistake by comparing a proper client with the broken one.

Microsoft's track record with embedded clients is that they don't process redirects and cookies properly. Since that's the usual cause of this error, I have no reason to think anything else.

-- Scott