How to add relying party (Azure AD (AFDS)) to Shib IdP V3

[Domingues, Michael D]

Clarification: You'll want to look here https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPShibbolethXML in particular, once again, assuming that your organization uses Azure AD as an Identity Provider, and you just want to protect an application using the Shibboleth Service Provider.


The quick summary (documentation covers all of this) is that you need to:


1) Configure your web server software to work with the Shibboleth SP (https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPIISConfig or https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig)

2) Make the Shibboleth SP aware of your Azure AD IdP by loading its metadata (https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider)

3) Map incoming requests to protect URLs that you care about (https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMapper)

4) Configure the Shibboleth SP to extract attributes (claims, in ADFS-speak) and pass them to your application (https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeExtractor and https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute)


Once again, this isn't a comprehensive list of what you'll need to do, but I'm hopeful it'll serve as a good starting point. To date, the Shibboleth SP is still on version 2.X, so if you're looking at version 3.X configuration, you're either looking at the IdP documentation pages (which won't help at all) or pre-release Shibboleth SP 3.X documentation (also not what you want).


Michael


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Domingues, Michael D <michael-domingues at uiowa.edu>
Sent: Monday, June 4, 2018 6:58:01 AM
To: users at shibboleth.net
Subject: Re: How to add relying party (Azure AD (AFDS)) to Shib IdP V3


Hi Jesper,


It appears that you're mixing up the IdP and the SP software. In this instance, because you want to use Azure AD as your Identity Provider, you don't need to run the Shibboleth IdP software on your web server, just the Shibboleth SP component.


The configuration you pasted below (from relying-party.xml) is for the IdP not the SP, so of course it's not having any effect on the SP configuration.


Documentation on SP configuration can be found here: https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfiguration


Best,

Michael


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Jesper <jesper.laursen at lego.com>
Sent: Monday, June 4, 2018 2:50:27 AM
To: users at shibboleth.net
Subject: How to add relying party (Azure AD (AFDS)) to Shib IdP V3

Hi

I would like to know if some one has one example for Shib Idp V3 how to
configure it to login via Azue AD (AFDS)

I have end-point definitions from Azure:
o SAML Single Sign-On Service URL:
https://login.microsoftonline.com/1d063515.../saml2
o SAML Entity ID: https://sts.windows.net/1d063515.../
o Sign-Out URL:
https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0
o SAML Signing Certificate - Base64 encoded o SAML Signing Certificate - Raw
o SAML XML Metadata


And I have my on premise Web server running Shibboleth SP + IdP 3 on IIS /
Jetty.
The /secure is kicking the scenario of: https://localserver.corp.com/secure

But it doesn't use the relying-party stuff:

<bean parent="RelyingPartyByName"
c:relyingPartyIds="urn:federation:MicrosoftOnline">
     <property name="profileConfigurations">
         <list>
                         <bean parent="SAML2.SSO"
p:encryptAssertions="false" />
         </list>
     </property>
</bean>

I have tried everything - but the above is the ones which doesn't make it
fail. It simply doesn't call Azure.
So I must be missing some keyword to trigger the Relying party that it
should be used for my: /secure path

I simply don't know where to find the proper configuration. For a newbee it
is hard to understand if it is V2 or V3 syntax. So that's why I'm hoping
that someone could actually share the steps to get authenticated in AFDS
(Azure AD) from a IIS with Shibboleth installed.
Thanks a lot...
This is killing me - slowly...




--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180604/5ce5d3f2/attachment.html>