<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<base href="x-msg://10/">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>Dematri,</div>
<div><br>
<blockquote type="cite"><span class="Apple-style-span" style="font-family: 'Times New Roman', serif; font-size: 16px; ">Office365 wants an "ImmutableID" for your users. You will need to decide what identifier is most immutable, unreassigned, persistent, etc.
and send it. It needs to, again, match the back-channel provisioning.</span><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">
<div lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<o:p></o:p></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 112, 192); "><o:p> </o:p></span></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 112, 192); ">May I understand that every id placed in the LDAP - SUN Enterprise need to have an Immutable ID field as well.</span></div>
</div>
</div>
</span></blockquote>
<div><br>
</div>
<div>It needs to have some unique identifier that matches the semantics and format of Immutable ID. The IdP can map an arbitrary attribute from your LDAP directory to ImmutableID on the wire, as shown in the example in the Microsoft documentation.</div>
<div><br>
</div>
<blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span class="Apple-style-span" style="color: rgb(0, 112, 192); font-family: Calibri, sans-serif; font-size: 15px; ">Which
make me understand that I need the AD object GUID, but how can I derived that as I am using LDAP – SUN Enterprise?</span></span></blockquote>
<div><br>
</div>
<div>You might use "uid" or something similar instead.</div>
<br>
<blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1" style="page: WordSection1; ">
<p class="MsoListParagraph" style="margin-right: 0in; margin-left: 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 112, 192); "><span>1)<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 112, 192); ">clicking
“My Email” will route the request to Office365.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-right: 0in; margin-left: 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 112, 192); "><span>2)<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 112, 192); ">which
in turn will route the request back to Shibboleth IDP and here the browser will provide the session cookie that would authenticate to Shibboleth.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-right: 0in; margin-left: 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 112, 192); "><span>3)<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 112, 192); ">Post
authentication, Shibboleth should provide the immutable id details to ADFS and thus allowing the user to log to Office 365 with SSO experience.<o:p></o:p></span></p>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(0, 112, 192); ">Is the process flow correct?</span></div>
</div>
</div>
</span></blockquote>
<div><br>
</div>
<div>Typically, yes. The user will have to authenticate if they haven't already.</div>
<br>
<blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: black; ">New Question:<o:p></o:p></span></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: black; ">Microsoft Article suggest -<span class="Apple-converted-space"> </span></span><span style="color: black; ">Install Windows PowerShell for single sign-on with Shibboleth<o:p></o:p></span></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="color: black; ">Ref:<span class="Apple-converted-space"> </span><a href="http://technet.microsoft.com/en-us/library/jj205464.aspx" style="color: blue; text-decoration: underline; "><span style="color: black; ">http://technet.microsoft.com/en-us/library/jj205464.aspx</span></a><o:p></o:p></span></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="color: rgb(0, 112, 192); "><o:p> </o:p></span></div>
<div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">
<span style="color: rgb(0, 112, 192); ">Do we need to install the Windows Azure Active Directory Module on the Shibboleth server or it be any Windows Based server?</span></div>
</div>
</div>
</span></blockquote>
<br>
</div>
<div>This is really a question for Microsoft but my understanding is that it expects to run in Windows Server on a trusted machine.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Nate.</div>
</body>
</html>