Second Office365 Domain requires different "Issuer URI"

[Lalith Jayaweera]

Hi All
I am going to try above solution shortly (inline script), but just to
clarify few things before I try, Given we already got offce365 working for
students I will only register the Staff domain end points with additional
param
e.g
$url =
"https://idp.contoso.com/idp/profile/SAML2/POST/SSO?morid=constoso.de"
$ecpUrl =
"https://idp.contoso.com/idp/profile/SAML2/SOAP/ECP?morid=contoso.de"
$uri = "https://idp.contoso.com/idp/shibboleth/contoso.de"

And I believe things will work as we got the default responderID in the
script.

Main other thing I want to clarify for the sake of completeness is
currently we got a override as below in relyingparty.xml

 <bean parent="RelyingPartyByName"
c:relyingPartyIds="urn:federation:MicrosoftOnline">
            <property name="profileConfigurations">
                <list>
         <bean parent="SAML2.SSO" p:encryptAssertions="false"
p:signAssertions="true" p:signResponses="false" p:encryptNameIDs="false"
p:authenticationFlows="#{{'Shibcas'}}" />
         <bean parent="SAML2.ECP" p:encryptAssertions="false"
p:signAssertions="true" p:signResponses="false"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
p:authenticationFlows="#{{'Password'}}"  />
                </list>
            </property>
        </bean>


and then we
use p:postAuthenticationFlowsLookupStrategy-ref="microsoftOnlineResponderIdScript"
 as stated below in the overides ? please confirm

e.g.

.....
.....

<bean parent="SAML2.SSO" p:encryptAssertions="false"
p:signAssertions="true" p:signResponses="false" p:encryptNameIDs="false"
p:authenticationFlows="#{{'Shibcas'}}"
p:postAuthenticationFlowsLookupStrategy-ref="microsoftOnlineResponderIdScript"
/>

         <bean parent="SAML2.ECP" p:encryptAssertions="false"
p:signAssertions="true" p:signResponses="false"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
p:authenticationFlows="#{{'Password'}}"
p:postAuthenticationFlowsLookupStrategy-ref="microsoftOnlineResponderIdScript"
 />






On Sat, Oct 14, 2017 at 6:44 AM Adam Crump <Adam.Crump at amkor.com> wrote:

> Opps, you are correct here is the complete script
> -->    <util:map id="microsoftOnlineRespondersIdMap">
>         <entry key="default" value="
> https://idp.contoso.com/idp/shibboleth/contoso />
>         <entry key="contoso " value="
> https://idp.contoso.com/idp/shibboleth/contoso.de" />
>     </util:map>
> <!-- Custome object for the inline script -->
>     <util:map id="customObjectsMicrosoftOnlineResponderIdScript">
>         <entry key="httpServletRequest"
> value-ref="shibboleth.HttpServletRequest" />
>         <entry key="microsoftOnlineRespondersIdMap"
> value-ref="microsoftOnlineRespondersIdMap" />
>     </util:map>
> <!-- responder script.  Look for a url parambeter of morid and check to
> see if the issuerID should be changed -->
>     <bean id="microsoftOnlineResponderIdScript"
> parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
>         p:customObject-ref="customObjectsMicrosoftOnlineResponderIdScript">
>         <constructor-arg>
>             <value>
>             <![CDATA[
>                 //by default we always return the default responderId
>                 responderId =
> custom.get('microsoftOnlineRespondersIdMap').get('default');
>                 //check to the existence of the key from the URL to switch
> the responder
>                 requestedResponder =
> custom.httpServletRequest.getParameter('morid');
>                 if
> (custom.microsoftOnlineRespondersIdMap.containsKey(requestedResponder)){
>                     responderId =
> custom.microsoftOnlineRespondersIdMap.get(requestedResponder);
>                 }
>                 responderId;
>             ]]>
>             </value>
>         </constructor-arg>
>     </bean>
>
>
> On 10/13/17, 2:26 AM, "users on behalf of Peter Schober" <
> users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at>
> wrote:
>
>     * adam.crump at amkor.com <adam.crump at amkor.com> [2017-10-13 00:51]:
>     > I have just stumbled upon this issue myself.  I would like to offer
> this
>     > alternative responderStrategy that can be managed completely in the
>     > relying-party.xml using an inline script.
>     [...]
>     >     <bean id="microsoftOnlineResponderIdScript"
>     > parent="shibboleth.ContextFunctions.Scripted"
> factory-method="inlineScript"
>     >
>  p:customObject-ref="customObjectsMicrosoftOnlineResponderIdScript">
>     >         <constructor-arg>
>     >             <value>
>     >
>     >             </value>
>     >         </constructor-arg>
>     >     </bean>
>
>     Seems to me there's missing something, e.g. the actual script?
>     -peter
>     --
>     To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190319/8f9c6d99/attachment.html>