<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 13-01-15 11:46 AM, Cantor, Scott
wrote:
</div>
<blockquote
cite="mid:BA63CEAE152A7742B854C678D949138349044ED3@CIO-KRC-D1MBX01.osuad.osu.edu"
type="cite">
<blockquote type="cite">
<pre wrap="">Here is the assertions I get when I authenticate with
<a class="moz-txt-link-abbreviated" href="mailto:michela@shibbdomain.eduteamit.net">michela@shibbdomain.eduteamit.net</a> in either WEB Mail (Internet Explorer)
and Outlook 2013 (Active Client). Please note that both of them only ask
the same 2 pieces of information (UPN + password), and I need to provide
both authentication mechanism, however as far as I understood I did NOT
configure a different filter policy or attributes set for WEB and ECP.
</pre>
</blockquote>
<pre wrap="">
No, you didn't. But your authentication is not the same. One of the
authentication approaches sets the principal name to a fully-qualified
Kerberos name with a realm, and the other one didn't. That results in two
different inputs to the resolver process and that's the cause of your
problem.</pre>
</blockquote>
You have two problems.<br>
<br>
The first, like Scott said, is that your web auth is returning
'<a class="moz-txt-link-abbreviated" href="mailto:michela@shibdomain.eduteamit.net">michela@shibdomain.eduteamit.net</a>' and your active auth is returning
just 'michela' for the UserId<br>
<br>
The other is that Office 365 requires ImmutableID (which is
objectGUID in your case) to be passed as the NameID. Your web auth
is passing the correct one, but your active auth is not<strong></strong><strong></strong><strong></strong><span
style="font-size:9.0pt;font-family:"Lucida
Console";color:#943634"></span>.<br>
</body>
</html>