How to add relying party (Azure AD (AFDS)) to Shib IdP V3

[Domingues, Michael D]

Hi Jesper,


It appears that you're mixing up the IdP and the SP software. In this instance, because you want to use Azure AD as your Identity Provider, you don't need to run the Shibboleth IdP software on your web server, just the Shibboleth SP component.


The configuration you pasted below (from relying-party.xml) is for the IdP not the SP, so of course it's not having any effect on the SP configuration.


Documentation on SP configuration can be found here: https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfiguration


Best,

Michael


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Jesper <jesper.laursen at lego.com>
Sent: Monday, June 4, 2018 2:50:27 AM
To: users at shibboleth.net
Subject: How to add relying party (Azure AD (AFDS)) to Shib IdP V3

Hi

I would like to know if some one has one example for Shib Idp V3 how to
configure it to login via Azue AD (AFDS)

I have end-point definitions from Azure:
o SAML Single Sign-On Service URL:
https://login.microsoftonline.com/1d063515.../saml2
o SAML Entity ID: https://sts.windows.net/1d063515.../
o Sign-Out URL:
https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
o SAML Signing Certificate - Base64 encoded o SAML Signing Certificate - Raw
o SAML XML Metadata


And I have my on premise Web server running Shibboleth SP + IdP 3 on IIS /
Jetty.
The /secure is kicking the scenario of: https://localserver.corp.com/secure

But it doesn't use the relying-party stuff:

<bean parent="RelyingPartyByName"
c:relyingPartyIds="urn:federation:MicrosoftOnline">
     <property name="profileConfigurations">
         <list>
                         <bean parent="SAML2.SSO"
p:encryptAssertions="false" />
         </list>
     </property>
</bean>

I have tried everything - but the above is the ones which doesn't make it
fail. It simply doesn't call Azure.
So I must be missing some keyword to trigger the Relying party that it
should be used for my: /secure path

I simply don't know where to find the proper configuration. For a newbee it
is hard to understand if it is V2 or V3 syntax. So that's why I'm hoping
that someone could actually share the steps to get authenticated in AFDS
(Azure AD) from a IIS with Shibboleth installed.
Thanks a lot...
This is killing me - slowly...




--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180604/0d5ea372/attachment.html>