Office 365 ECP Issues

[Cantor, Scott]

Also, it goes without saying that you can't just do things blindly here. I made a suggestion in context. When I said to tell the ECP profile to direct itself to use RemoteUserInternal, that was with the implicit assumption that you were going to configure that flow in accordance with the documentation, and enable it via the idp.login.flows property expression. If you did none of these things, then, no, it's not going to do anything but fail.

The V3 ECP support is designed to be used with the Password flow to make it simple for people to deploy without extra work since most people were using the password support in V2.

The authenticationFlows property isn't normally something you would set, but I think it's the most natural way to get the system to support two separate "isolated" flows that work separately for browser and ECP. You would configure each login flow separately, but correctly, enable both in the property setting that turns on the flows, and then direct ECP to use one and the browser-based flows like SAML2.SSO to use the other. Then they're both functioning essentially in isolation but together in the system at the same time.

I have never done this specifically, but that's my general guess as to the simplest way to do it with the least chance to introduce side effects.

-- Scott

On 7/18/17, 11:31 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

On 7/17/17, 11:34 PM, "users on behalf of Lalith Jayaweera" <users-bounces at shibboleth.net on behalf of ljayaweera at gmail.com> wrote:

> you mean something like below, but same failure result ....with authentication issue  

Then you need to use logs, read the documentation, determine what actually is going wrong, etc. You are running a complicated set of options and approaches and that means you will have to learn and understand much more than somebody following the more advisable, out of the box, approaches.

-- Scott