O365 Federated domain with Shibboleth-IdP: passive and active loginUri

[Francesco Malvezzi]

My organization is a federated domain on O365/Azure AD and
authentication happens via SAML2 in a shibboleth-idp.

This works fine with web sites, and most application like the Teams app
for example. On login user is redirected to the IdP Login url, that MS
calls passive, with the
http://shibboleth.net/ns/profiles/saml2/sso/browser profile HTTP-POST.

Windows 10 clients login don't work and that is expected. This login is
handled by an AD controller.

After with wrap-up (it is more a note to self, but please let me know if
I am wrong) comes my question.

I am facing the 'Quick Assistance' app that really looks like the app of
first type, the working ones: after pressing the 'give help' button, it
allows user to insert a full scoped username and redirect her to IdP.
But it fails protocol because calls the

GET /idp/profile/SAML2/POST/SSO HTTP/1.1

and of course IdP can't answer (a GET request on a POST-only url).

I can't find reports 'Quick Assistance' should or shouldn't work with a
federated domain. Can someone confirm that?

Is it possible 'Quick Assistance' needs to use active authentication (=
ECP)?

It is quite hard to debug those apps and also documentation has some
shortcomings, so really thank you for your help,

Francesco

-- 
servizio gestione identità
Università di Modena e Reggio Emilia