MS Autopilot with Shibboleth

[Muhammad Farhan SJAUGI]

Hi Matt,

I haven't tested yet with MS Autopilot, but I managed to make
Shibboleth IdP work with the MS OOBE.

What I did was, I put the ADFS (proxy) server in between Shibboleth
IdP and Entra ID, and used WS-Fed/WS-Trust to connect the ADFS and
EntraID.

However, you may need to list some MS authentication context,
particularly http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password
in the Shibboleth IdP's supported AuthenticationContext.

So far our method works well with Office365, Entra Join, and also OOBE.

Regards

--
Ts. Muhammad Farhan Sjaugi, S.Kom. M.Sc.
VP (Engineering and Services)
SIFULAN Malaysian Access Federation
Email: farhan at sifulan.my | Website: https://www.sifulan.my
PGP Fingerprint: 9AA0 1861 0921 3EBD 4E30 716A 1F71 FC55 49CD D06C
MBOT: GT20040131 |  ORCID: https://orcid.org/0000-0001-8497-1768
Credly: https://www.credly.com/users/muhammad-farhan-sjaugi

On Wed, Oct 30, 2024 at 11:05 PM Matt Brennan via users
<users at shibboleth.net> wrote:
>
> Hi Folks,
>
>   Has anyone gotten MS Autopilot to work while federating Entra (formerly known as Azure AD) to Shibboleth? We're running into an issue right now where we get an error at the very first login screen which says the identity was not found in the directory.
>
>   Our implementation partner is telling us that this will never work because the IdP needs to support WS-Trust (referencing this article: https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join).
>
>   All the posts I'm finding agree, but they're also all several years old. I just wanted to see if anyone had made this work recently -- either through Shibboleth, or by some hackery to let the user authenticate via Entra only for Autopilot.
>
> Thanks,
> Matt
> --
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net