MS Autopilot with Shibboleth

[Muhammad Farhan SJAUGI]

Hi Matt,

You can ask Entra to ignore the MFA from the IdP. Just edit the
FederatedIdpMfaBehavior  properties to  "rejectMfaByFederatedIdp". In
this case, Entra will use Entra MFA instead.

However, you may need to use GraphAPI to do so.

Regards

--
Ts. Muhammad Farhan Sjaugi, S.Kom. M.Sc.
VP (Engineering and Services)
SIFULAN Malaysian Access Federation
Email: farhan at sifulan.my | Website: https://www.sifulan.my
PGP Fingerprint: 9AA0 1861 0921 3EBD 4E30 716A 1F71 FC55 49CD D06C
MBOT: GT20040131 |  ORCID: https://orcid.org/0000-0001-8497-1768
Credly: https://www.credly.com/users/muhammad-farhan-sjaugi

On Thu, Oct 31, 2024 at 11:56 PM Matt Brennan via users
<users at shibboleth.net> wrote:
>
> Thanks, everyone, for the responses.
>
> Unfortunately using Entra native authentication isn't an option. We're OK with password hash sync (we're actually already doing it to accomplish SSPR for contractors) but we don't want to *force* all of our users enroll in MFA twice.
>
> Sounds like the answer is we need to resurrect AD FS for Autopilot. Unless we can figure out how to get MS to let us federate just the MFA portion.
>
> -Matt
>
> On Wed, 30 Oct 2024 at 14:37, Youssef GHORBAL <youssef.ghorbal at pasteur.fr> wrote:
>>
>> Hi,
>>
>> Autopilot in Entra federation scenarios requires the IdP to support WS-Trust[0] which Shibboleth does not.
>> Your options are:
>> - AD Hash sync, where your AD acounts and passwords hashes are synced to EntraID and you don't federate your o365 tenant. In that case users use standard Microsoft auth screens and not your institutional portal for *ALL* o365 based apps (Teams, office.com, etc)
>> - EntraID federation with an IdP that supports WS-Trust. The only one I'm aware of that you can roll inhouse is ADFS. The rest of viable options are Cloud based basically (Okta, Duo, etc)
>> In the ADFS scenario, I'm not sure how much WS-Trust endpoints that you'll end up exposing on Internet are immune against brute force (my WS-* is rusty) so you may also look into protection strategies[1]
>>
>> From my understanting, this "requirement" for WS-Trust boils down to the fact that in federated EntraID scenarios MS does not have your password and at some point in the enrollement process, you'll be prompted to authenticate with corp credentials that needs to be checked (agains your IdP) without a browser/user interaction, more details here[2]. So I guess they ended digging up WS-Trust.
>>
>> By the way in macOS env, you'll need WS-Trust as well for Platform SSO[3] for the same reasons I guess.
>>
>> Last but not least, I don't know if you go down to alternative auth methods for Windows (hardware tokens or Windows Hello) you can workaround the WS-Trust requirement.
>>
>> Youssef
>>
>> [0] https://learn.microsoft.com/en-us/entra/identity/devices/device-join-plan#federated-environment
>> [1] https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-extranet-smart-lockout-protection
>> [2] https://learn.microsoft.com/en-us/entra/identity/devices/concept-primary-refresh-token#prt-issuance-during-first-sign-in
>> [3] https://support.apple.com/en-gb/guide/deployment/dep7bbb05313/web
>>
>> On 30 Oct 2024, at 16:04, Matt Brennan via users <users at shibboleth.net> wrote:
>>
>> Hi Folks,
>>
>>   Has anyone gotten MS Autopilot to work while federating Entra (formerly known as Azure AD) to Shibboleth? We're running into an issue right now where we get an error at the very first login screen which says the identity was not found in the directory.
>>
>>   Our implementation partner is telling us that this will never work because the IdP needs to support WS-Trust (referencing this article: https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join).
>>
>>   All the posts I'm finding agree, but they're also all several years old. I just wanted to see if anyone had made this work recently -- either through Shibboleth, or by some hackery to let the user authenticate via Entra only for Autopilot.
>>
>> Thanks,
>> Matt
>> --
>> For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!JFdNOqOXpB6UZW0!v-xl4MeYNTrsIs0ZNnWRNLIR1aRUkpHm52wO91G2E2BS4eDUChxcHiSW0silm20uVRNOlE-jIr6BTvruVqRz9EYysw$
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>>
>>
> --
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net