How to add relying party (Azure AD (AFDS)) to Shib IdP V3

Jesper jesper.laursen at lego.com
Mon Jun 4 03:50:27 EDT 2018


Hi 

I would like to know if some one has one example for Shib Idp V3 how to
configure it to login via Azue AD (AFDS) 

I have end-point definitions from Azure: 
o SAML Single Sign-On Service URL:
https://login.microsoftonline.com/1d063515.../saml2
o SAML Entity ID: https://sts.windows.net/1d063515.../
o Sign-Out URL:
https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
o SAML Signing Certificate - Base64 encoded o SAML Signing Certificate - Raw
o SAML XML Metadata 


And I have my on premise Web server running Shibboleth SP + IdP 3 on IIS /
Jetty. 
The /secure is kicking the scenario of: https://localserver.corp.com/secure

But it doesn't use the relying-party stuff: 

<bean parent="RelyingPartyByName"
c:relyingPartyIds="urn:federation:MicrosoftOnline">  
     <property name="profileConfigurations">  
         <list>  
                         <bean parent="SAML2.SSO"
p:encryptAssertions="false" />                  
         </list>  
     </property>
</bean>  

I have tried everything - but the above is the ones which doesn't make it
fail. It simply doesn't call Azure. 
So I must be missing some keyword to trigger the Relying party that it
should be used for my: /secure path 

I simply don't know where to find the proper configuration. For a newbee it
is hard to understand if it is V2 or V3 syntax. So that's why I'm hoping
that someone could actually share the steps to get authenticated in AFDS
(Azure AD) from a IIS with Shibboleth installed. 
Thanks a lot... 
This is killing me - slowly... 




--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html


More information about the users mailing list