MS Autopilot with Shibboleth

[Matt Brennan]

Hi Muhammad,

  Thanks for the reply. I just want to make sure I understand you
correctly. You deployed only the ADFS proxy -- you didn't actually need to
build an ADFS cluster in your domain? So the proxy handled the
WS-Federation requests, but Shib handled the SAML auth still? If that's
correct, that certainly seems less daunting than running an AD FS cluster
just to support Autopilot.

-Matt

On Wed, 30 Oct 2024 at 11:26, Muhammad Farhan SJAUGI <farhan at sifulan.my>
wrote:

> Hi Matt,
>
> I haven't tested yet with MS Autopilot, but I managed to make
> Shibboleth IdP work with the MS OOBE.
>
> What I did was, I put the ADFS (proxy) server in between Shibboleth
> IdP and Entra ID, and used WS-Fed/WS-Trust to connect the ADFS and
> EntraID.
>
> However, you may need to list some MS authentication context,
> particularly
> http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password
> in the Shibboleth IdP's supported AuthenticationContext.
>
> So far our method works well with Office365, Entra Join, and also OOBE.
>
> Regards
>
> --
> Ts. Muhammad Farhan Sjaugi, S.Kom. M.Sc.
> VP (Engineering and Services)
> SIFULAN Malaysian Access Federation
> Email: farhan at sifulan.my | Website: https://www.sifulan.my
> PGP Fingerprint: 9AA0 1861 0921 3EBD 4E30 716A 1F71 FC55 49CD D06C
> MBOT: GT20040131 |  ORCID: https://orcid.org/0000-0001-8497-1768
> Credly: https://www.credly.com/users/muhammad-farhan-sjaugi
>
> On Wed, Oct 30, 2024 at 11:05 PM Matt Brennan via users
> <users at shibboleth.net> wrote:
> >
> > Hi Folks,
> >
> >   Has anyone gotten MS Autopilot to work while federating Entra
> (formerly known as Azure AD) to Shibboleth? We're running into an issue
> right now where we get an error at the very first login screen which says
> the identity was not found in the directory.
> >
> >   Our implementation partner is telling us that this will never work
> because the IdP needs to support WS-Trust (referencing this article:
> https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join
> ).
> >
> >   All the posts I'm finding agree, but they're also all several years
> old. I just wanted to see if anyone had made this work recently -- either
> through Shibboleth, or by some hackery to let the user authenticate via
> Entra only for Autopilot.
> >
> > Thanks,
> > Matt
> > --
> > For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> > To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241030/1cbac997/attachment.htm>