ADFS 2 as Shib Proxy

[Andy Swiffin (Staff)]

I agree totally.

We ditched our ADFS a year ago and moved O365 authentication to Azure AD and it's been very well received.   We're gradually moving some other services (Blackboard, SITS eVision, Topdesk etc) to Azure AD directly as well, configuration of the non-gallery app to produce the correct attributes for the Shibboleth SP is pretty straightforward.

This may help the OP as from memory configuration of ADFS claims was pretty nasty (which is why we never did it) but with Azure AD you can release urn:oid type attributes or pretty much anything you want very easily.  Beware though, you do need AAD Premium licensing to get the full benefits (we make big use of the SSPR, it reduced our password reset calls by 60%).

What we've also just done, which may be of interest to some, is outsource our Shibboleth IdP to a company in the UK called Overt Software who have an authentication bridge which passes the Shibboleth IdP authentication on to Azure AD (or ADFS if you want) (https://www.overtsoftware.com/adfs-shibboleth-bridge/).   This means we get the best of both worlds with SSO between the Shibboleth authenticated world and the Azure AD authenticated world irrespective of which you go to first.

Cheers
Andy Swiffin
Dundee
Scotland


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: 01 September 2017 17:08
To: Shib Users <users at shibboleth.net>
Subject: Re: ADFS 2 as Shib Proxy

On 9/1/17, 12:03 PM, "users on behalf of Goggins, Patrick" <users-bounces at shibboleth.net on behalf of gogginsp at uwgb.edu> wrote:

> "Be aware ADFS is a dead product walking"
>
> Have anything from Microsoft backing this?

Nope, just common sense and tea leaf reading IMHO. Azure is where it's at.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

The University of Dundee is a registered Scottish Charity, No: SC015096