<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><base href="x-msg://10/"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#0070C0;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:359670374;
mso-list-type:hybrid;
mso-list-template-ids:-1266675950 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>Hello Nate,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>First of thanks for responding.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>Sorry but going through the Microsoft article, I have few basic & probably stupid questions. But request the user community including Nate to respond as it will help to get the concept clear.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><o:p> </o:p></span></p><p class=MsoNormal style='text-indent:-.25in'><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060'>b)</span><span lang=EN-AU style='font-size:7.0pt;color:#002060'> <span class=apple-converted-space> </span></span><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060'>b) If yes, then the attribute for authentication can be the user login id rather email address, as we are using it currently.</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Office365 wants an "ImmutableID" for your users. You will need to decide what identifier is most immutable, unreassigned, persistent, etc. and send it. It needs to, again, match the back-channel provisioning.<o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>May I understand that every id placed in the LDAP - SUN Enterprise need to have an Immutable ID field as well.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>I guess, still not clear on this.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>Will the UPN act as an immutable id? – I felt for a moment.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>But as the Microsoft – <a href="http://technet.microsoft.com/en-us/library/jj205463.aspx#BKMK_1">http://technet.microsoft.com/en-us/library/jj205463.aspx#BKMK_1</a> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><o:p> </o:p></span></p><p class=MsoNormal style='margin-left:.5in'>Windows Azure AD <strong>ImmutableID</strong><br><br>Windows Azure AD requires you select a unique identifier for each user in your user directory. You must also configure Shibboleth to send this attribute on each federated login to Windows Azure AD in the SAML 2.0 NameID assertion. This identifier must not change for this user over the lifetime of the user being in your system. The Windows Azure AD Service calls this attribute the “ImmutableID”. <b>The value for the unique identifier must not contain domain information and is case-sensitive.<br><br>For example, do not use user@contoso.com. In the recommended code below, the value used will be the Active Directory objectGUID property that is base64-encoded</b>. When creating accounts, you must ensure the ImmutableID is processed the same way or the user will not be able to sign in to the Microsoft cloud service. The Windows Azure Active Directory Sync tool automatically uses the Active Directory objectGUID for the ImmutableID value and processes the ImmutableID the same way as in the following recommended example:<span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>Which make me understand that I need the AD object GUID, but how can I derived that as I am using LDAP – SUN Enterprise?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><o:p> </o:p></span></p><p class=MsoNormal style='text-indent:-.25in'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>c) </span><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060'>c)</span><span lang=EN-AU style='font-size:7.0pt;color:#002060'> <span class=apple-converted-space> </span></span><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060'>Once replaced with Shibboleth for Email access. Now user logs to Student portal using their Student Login id, post authentication while clicking on “My Email” will Shibboleth pick the email address from the cookie session and provide the same to Office 365 thus allowing user a SSO experience to access emails?</span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>"My Email" probably leverages a field in your back-channel provisioning(likely mail), but it could try to build an email address for the user using ImmutableID. This is a question to ask to Microsoft and another potential area of improvement.<o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>In my case:<o:p></o:p></span></p><p class=MsoListParagraph style='margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><span style='mso-list:Ignore'>1)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>clicking “My Email” will route the request to Office365.<o:p></o:p></span></p><p class=MsoListParagraph style='margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><span style='mso-list:Ignore'>2)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>which in turn will route the request back to Shibboleth IDP and here the browser will provide the session cookie that would authenticate to Shibboleth. <o:p></o:p></span></p><p class=MsoListParagraph style='margin-left:.5in;text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><span style='mso-list:Ignore'>3)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>Post authentication, Shibboleth should provide the immutable id details to ADFS and thus allowing the user to log to Office 365 with SSO experience.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>Is the process flow correct?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>New Question:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'>Microsoft Article suggest - </span><span style='color:black'>Install Windows PowerShell for single sign-on with Shibboleth<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Ref: <a href="http://technet.microsoft.com/en-us/library/jj205464.aspx"><span style='color:black'>http://technet.microsoft.com/en-us/library/jj205464.aspx</span></a><o:p></o:p></span></p><p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#0070C0'>Do we need to install the Windows Azure Active Directory Module on the Shibboleth server or it be any Windows Based server?</span><o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>Regards,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#0070C0'>Dematri<o:p></o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif"'> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net] <b>On Behalf Of </b>Nate Klingenstein<br><b>Sent:</b> Thursday, June 6, 2013 2:00 AM<br><b>To:</b> Shib Users<br><b>Subject:</b> Re: Shibboleth for Office 365 (Authentication decision)<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Dematri, <o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p><div><div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060'>Looking for valuable advice for the below scenario in order to implement Shibboleth for Office 365.</span><o:p></o:p></p></div></div></blockquote><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>The best advice I can offer is to please encourage Microsoft to work on their implementation/documentation so we don't have to field so many Office 365 questions.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoListParagraph style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in;text-indent:-.25in'><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060'>a)</span><span lang=EN-AU style='font-size:7.0pt;color:#002060'> <span class=apple-converted-space> </span></span><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060'>Our Shibboleth is getting authenticated by LDAP – SUN Enterprise Directory 5.2. Therefore from Shibboleth Federation with Office 365 perspective, can it use the same LDAP to authenticate users rather than AD?</span><o:p></o:p></p></div></blockquote><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>The account information coming from Shibboleth will need to match the account information provisioned to Microsoft(for now, with a strange little tool called DirSync). If your data in both matches, then you can use the same LDAP.<o:p></o:p></p></div><p class=MsoNormal><br><br><o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div style='margin-left:.5in'><p class=MsoNormal style='text-indent:-.25in'><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060'>b)</span><span lang=EN-AU style='font-size:7.0pt;color:#002060'> <span class=apple-converted-space> </span></span><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060'>If yes, then the attribute for authentication can be the user login id rather email address, as we are using it currently.</span><o:p></o:p></p></div></div></blockquote><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Office365 wants an "ImmutableID" for your users. You will need to decide what identifier is most immutable, unreassigned, persistent, etc. and send it. It needs to, again, match the back-channel provisioning.<o:p></o:p></p></div><p class=MsoNormal><br><br><o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div style='margin-left:.5in'><p class=MsoNormal style='text-indent:-.25in'><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060'>However I understand for SSO to Office 365 you need to provide email address. Is it possible to have the email address in the background provided by Shibboleth to Office 365?</span><o:p></o:p></p></div></div></blockquote><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>It's not clear to me that they're asking for email address in addition. But that's going by their documentation, so I could very well be wrong.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><a href="http://technet.microsoft.com/en-us/library/jj205463.aspx">http://technet.microsoft.com/en-us/library/jj205463.aspx</a><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div style='margin-left:.5in'><p class=MsoNormal style='text-indent:-.25in'><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060'>c)</span><span lang=EN-AU style='font-size:7.0pt;color:#002060'> <span class=apple-converted-space> </span></span><span lang=EN-AU style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#002060'>Once replaced with Shibboleth for Email access. Now user logs to Student portal using their Student Login id, post authentication while clicking on “My Email” will Shibboleth pick the email address from the cookie session and provide the same to Office 365 thus allowing user a SSO experience to access emails?</span><o:p></o:p></p></div></div></blockquote><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>"My Email" probably leverages a field in your back-channel provisioning(likely mail), but it could try to build an email address for the user using ImmutableID. This is a question to ask to Microsoft and another potential area of improvement.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Thanks,<o:p></o:p></p></div><div><p class=MsoNormal>Nate.<o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p></div></div></div></body></html>