How to add relying party (Azure AD (AFDS)) to Shib IdP V3

[Gernot Hassenpflug]

Jesper <jesper.laursen at lego.com> writes:

> That's a good question...
> I actually also thought that I only need the SP and then make it use the IdP
> on Azure (AFDS).
> But all examples so far I have found indicates that the relying-party.xml
> for the IdP must be altered.
> And for me the examples are also not quite right because they indicate setup
> for LDAP as well - and that is totally hidden when we use AFDS.

>From my experience, just need three things:
1. entityID of the IdP, which is some nasty URL maybe looking like
   https://<somedomain>/<somerandomstring>
   
2. metadata set up for the IdP, which should be simply via their URL,
   which probably looks along the lines of
   https://login.windows.net/<somerandomstring>/federationmetadata/2007-06/federationmetadata.xml

3. the definition of the thingie used to specify the user.

Azure by default sends an attribute that has a URL as its name, nothing
short like eppn. According to the documentation the admins can set up
SAML2 properly and map whatever is in their AD server to become a
standard SAML2 attribute like eppn, but if they don't, can't or won't,
then they end up sending a whole lot of crap to the SP (terrible
security), one of which is what you need. LOL

So then figure out which of those attributes is the correct one, define
that thingie in attribute-map.xml with a friendly name, and then use it
in shibboleth2.xml (we use it in REMOTE_USER).

 <Attribute
        name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
        id="<choosefriendlynameforthisattribute>">
        <AttributeDecoder xsi:type="ScopedAttributeDecoder"/>
 </Attribute>

That seems to be the standard NameID for Azure.

Hope that helps,
Gernot Hassenpflug
-- 
Asahi Net, Inc.
Tokyo, Japan