How to add relying party (Azure AD (AFDS)) to Shib IdP V3

[Peter Schober]

* Jesper <jesper.laursen at lego.com> [2018-06-06 14:10]:
> I can follow that I need to add the metadataprovider to the shibboleth2.xml
> file.

https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration
-> "Talk to a New Identity Provider" and from there, e.g.
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider

> But I really don't understand the SSO entity in ApplicationDefaults.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO

> Because it should point to something else I guess.
> 			
>             <SSO entityID="https://dkatec-ts1.corp.lego.com/idp/shibboleth"
>                  discoveryProtocol="SAMLDS"
> discoveryURL="https://dkatec-ts1.corp.lego.com:543/DS/WAYF">
>               SAML2 SAML1
>             </SSO>

You don't say what your intention is. The above will always send all
subjects to the IDP with the given entityID whenever SSO should be
initiated and the IDP is not selected/provided any other way.
I.e., the IDP Discovery Service you configured with the discoveryURL
parameter will never be used.

None of this has anything to do with adding SAML metadata (describing
the IDP) to the SP.

-peter