ADFSv3 IdP3.3 differences from v2

[O'Dowd, Josh]

Greetings,

We are about to attempt to federate our O365 users (sans AzureAD).  We have an ADFSv3 server farm being configured to use our IdP3.3.0 as claim provider.  I have been reviewing the only available doc on the subject that I could find in the Shibboleth community[1].  Having done that, I am wondering about the MS Authentication Context, config in IdP3.3, since authn context config had significant changes from v2.

Is the solution for supporting the MS Authentication Context (http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password) in IdP3.3 as easy as adding that to the list of supported principals in our authn/MFA flow(our default flow), in the /conf/authn/general-authn.xml, like:

<bean id="authn/MFA" parent="shibboleth.AuthenticationFlow">
                        <property name="supportedPrincipals">
                                        <list>
                                                <bean parent="shibboleth.SAML2AuthnContextClassRef"
                                                        c:classRef="http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password" />
                                                <bean parent="shibboleth.SAML2AuthnContextClassRef"
                                                        c:classRef="http://www.umt.edu/mfa" />
                                                <bean parent="shibboleth.SAML2AuthnContextClassRef"
                                                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
                                        </list>
                        </property>
                    </bean>

                ...  then maybe a RelyingPartyOverride for the ADFS entites where the SAML2.SSO profile sets a defaultAuthenticationMethod to the MS Authentication method?

I am hoping v3.3.x avoids the need to create a duplicate to authn/Password flow, as the old article suggests.

Thanks.

Josh O'Dowd
Software Systems Engineer / Identity Access Management
Central IT, University of Montana

[1] - https://wiki.shibboleth.net/confluence/display/SHIB2/MicrosoftInterop#MicrosoftInterop-ADFSV2

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170324/9dfa7650/attachment-0001.html>