Office 365 ECP Issues

[Lalith Jayaweera]

Hi,

For Office365 web profile works with no issues, just that ECP profile does
not seem to work, certainly it hits the IdP, hence Apache authentication is
success and see entries in idp logs

 relaying party I got below config

<bean parent="RelyingPartyByName"
 c:relyingPartyIds="urn:federation:MicrosoftOnline">
            <property name="profileConfigurations">
                <list>
         <bean parent="SAML2.SSO" p:encryptAssertions="false"
p:signAssertions="true" p:signResponses="false" p:encryptNameIDs="false" />
         <bean parent="SAML2.ECP" p:encryptAssertions="false"
p:signAssertions="true" p:signResponses="false"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
/>
                </list>
            </property>
        </bean>


and able to see below error in logs, anyone success getting ECP for office
365 with IdP 3.x, all working for me with IdP 2.4.X


<?xml version="1.0" encoding="UTF-8"?>

<soap11:Envelope xmlns:soap11="http://schemas.xmlsoap.org/soap/envelope/">

    <soap11:Header>

        <ecp:Response

            AssertionConsumerServiceURL="
https://login.microsoftonline.com/login.srf"

            soap11:actor="http://schemas.xmlsoap.org/soap/actor/next"

            soap11:mustUnderstand="1"
xmlns:ecp="urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp"/>

    </soap11:Header>

    <soap11:Body>

        <saml2p:Response

            Destination="https://login.microsoftonline.com/login.srf"

            ID="_dssssbf856bafea5db12da9c4095df9eecf1"

            InResponseTo="_f0sssss1ec32e-2e9d-4bd8-98ee-d9846d855c3e"

            IssueInstant="2017-07-17T06:56:32.323Z" Version="2.0"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">

            <saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
https://myidp.x.y/idp/shibboleth</saml2:Issuer
<https://idpuatweb1.vu.edu.au/idp/shibboleth%3c/saml2:Issuer>>

            <saml2p:Status>

                <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Requester">

                    <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/>

                </saml2p:StatusCode>

                <saml2p:StatusMessage>An error
occurred.</saml2p:StatusMessage>

            </saml2p:Status>

        </saml2p:Response>

    </soap11:Body>

</soap11:Envelope>




On Tue, Jul 11, 2017 at 9:51 PM, Matthew Slowe <M.Slowe at kent.ac.uk> wrote:

> On 11/07/2017 07:19, Lalith Jayaweera wrote:
> > I configured the office 365 in IdP 3.3.x and mail (Web profile) works
> > with no issues,
> >
> > However, ECP does not seem to work. Mobile phone mail setup....
> >
> > Given same DNS of IdP, no change done in microsoft end.
> >
> > However when I try ECP via mobile phone, I can't see any logs in IdP, as
> > if like not hit to IdP
> >
> > Is there any way to track down or run some test clients to see where the
> > blockage is?
>
> There weren't any simple ways to diagnose ECP issues last time I looked.
>
> I've published a simpleish way to make an ECP request into your IDP
> (taking Microsoft out of the loop) to check it's issuing a useful response:
>
> https://github.com/unikent-ms1/simple-soap-ecp-test
>
> Something to check is that the certificate in use on the HTTPS endpoint
> matches the signing certificate registered with Office365 for the IDP
> *and* is signed/validated by a mainstream CA (I think if Internet
> Explorer is happy with it then it should be fine).
>
> --
> Matthew Slowe | Server Infrastructure Officer
> IT Infrastructure, Information Services, University of Kent
> Room S21, Cornwallis South
> Canterbury, Kent, CT2 7NZ, UK
> Tel: +44 (0)1227 824265
>
> www.kent.ac.uk/is | @UnikentUnseenIT | @UKCLibraryIt
> PGP: https://keybase.io/fooflington
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170717/6150f171/attachment.html>