Issue with interoperability between ADFS 2016 and Shibboleth 2.4.4

[Alvarez, Dyana I]

Hi,
We are going through an issue with our new ADFS 2016 upgrade and current environment Shibboleth 2.4.4
I will describe our current ADFS 2.0 and Shibboleth 2.4.4
WE have a load balancer that is fronting ADFS. In the LB we have an iRule that appends the cookie MSIPIPSelectionPersistent with a value in the HTTP header.
That value is based on where the user is coming from.
We have it set up such that:

If the user is coming from an smartphone app (active - outlook/exchange app)
                append cookie value with the ADFS url to authenticate (example: MSIPIPSelectionCookie="https://adfs.miami.edu")

if the user is coming from a web browser (passive)
                append cookie value with the Shibboleth URL to authenticate (example: MSIPIPSelectionCookie=https://shibboleth.miami.edu)

This cookie is supposed to help avoiding showing the ADFS screen for the user to choose how they want to authenticate (in a drop down that shows Active Directory and Shibboleth instance).
This works perfectly fine in our ADFS 2.0 and Shibboleth 2.4.4.
However, we are in the process of upgrading from ADFS 2.0 to ADFS 2016.
in our test environment, the iRule does not work with the active connections (Smarphones outlook/exchange app for email) but it works fine with a browser (passive).  It does not show the drop down to choose and just redirects our Test email web based outlook to our Shibboleth login page.
However, the app for outlook when adding a new account, gives an error in ADFS.

Can someone out there have done ADFS 2016 with Shibboleth interoperability before?

By the way, these are the iRule:

when HTTP_REQUEST {

    if {[string tolower [HTTP::query]] contains "wauth=http://schemas.microsoft.com/ws/"}  {

         # Set the value we will use for the MSISIPSelectionPersistent cookie to
         # the Base64 encoded ADFS entityID we want the user to authenticate with.
         # The entityID that encodes is "http://adfs.miami.edu'

         set cookieValue "ijusoiadfjioasdklfjaslkdf"

    } else {

         # Set the value we will use for the MSISIPSelectionPersistent cookie to
         # the Base64 encoded IdP entityID we want the user to authenticate with.
         # The entityID that encodes is "https://shibboleth.miami.edu'

         set cookieValue "asdfdasfsadfsadfadfsdf"
    }

    if {[HTTP::header exists Cookie]} {

          set cookie [HTTP::header value Cookie]
          append cookie "; MSISIPSelectionPersistent=$cookieValue"
          HTTP::header remove Cookie
          HTTP::header insert Cookie $cookie
          log local0. "Cookie: $cookie"

     } else {
          set cookie [HTTP::header value Cookie]
          append cookie "MSISIPSelectionPersistent=$cookieValue"
          HTTP::header remove Cookie
          HTTP::header insert Cookie $cookie
          log local0. "Cookie: $cookie"
     }
}

Thank you,

Dyana Alvarez, M.Sc.
Sr. Programmer
P: (305) 284-3521
[cid:image001.png at 01D362B2.650C9320]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171121/b3b44f58/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 16103 bytes
Desc: image001.png
URL: <http://shibboleth.net/pipermail/users/attachments/20171121/b3b44f58/attachment-0001.png>