Shib v4 proxying to Azure SSO for authn

[Matthew Slowe]

> On 23 Sep 2020, at 22:43, Jeffrey Williams via users <users at shibboleth.net> wrote:
> 
> Hi All,
> 
> I was curious to know if other universities have looked at the proxying(https://wiki.shibboleth.net/confluence/display/IDP4/AuthenticationConfiguration#AuthenticationConfiguration-Proxying) capabilities in Shibboleth v4 with an eye towards Azure SSO?  It's something we've had an interest in for some time, but we still have to upgrade to v4 first.
> 
> I'm curious to know if anyone's worked on it.  If so, how far along is the effort and are there any tips or tricks beyond the documentation from either MS or Shibboleth that proved to be effective?

I've been playing with it for a while and have it working (with a bit of help from colleagues in Canada!). I've written up a general (non-Azure specific) guide in the Shibboleth Wiki:

https://wiki.shibboleth.net/confluence/display/KB/Using+SAML+Proxying+to+another+IdP

I think I need to add some notes to it but it should get you most of the way there.

Making it work with Azure requires creating a new set of attribute transcoding rules  in .../conf/attributes either using the XML or .properties methods to let it understand the incoming assertion from Azure. I think there's a more specific KB article in the pipeline from someone else... 

It works for the modern (front-channel) case. It doesn't work when back-channel is involved and you're relying on attributes imported from the upstream assertion (rather than looking them up in a local directory).

Hope that helps,
-- 
Matthew Slowe (GPG: 0x6BE0CF7D04600314)
Technical Specialist - Trust & Identity, Jisc
Team: 0300 300 2212, option 2
Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG