<div dir="ltr"><div>I'm not sure I can help you. Based on my understanding, what I've been trying to convey is the FederationMetadataUrl parameter you speak of only applies to an ADFS setup and is not relevant (or even accessible) to a SAML setup, so I am confused as to why you are hung up on it or why you even have a value there in the first place. In a SAML setup, the O365 metadata is stored in a static file on your IdP and your IdP's metadata (ie signing certificate) is uploaded directly to you O365 by using the -SigningCertificate param of the Set-MsolDomainAuthentication cmdlet... there is no url involved for metadata retrieval, on either side.</div>
<div><br></div><div>The Get-MsolFederationProperty cmdlet that shows the FederationMetadataUrl property you speak of only applies to ADFS Federated domains and is far as I can tell is useless for SAML... in fact if I run it, it will error telling me my domain isn't federated with ADFS (though its working and federated with SAML). Remember, Microsoft speak for "federating" is referring a specific product, ie WSFed/ADFS... using Shibb/SAML is not federating with O365, but just a special kind of authentication configuration somewhere between a Managed and Federated domain... so expect most of the cmdlets with "Federating/Federation" in them to not apply to a SAML setup.</div>
<div><br></div><div>-Rob</div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Aug 19, 2014 at 3:43 PM, Farzan Qureshi <span dir="ltr"><<a href="mailto:fqureshi@rosmini.school.nz" target="_blank">fqureshi@rosmini.school.nz</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div>Hi Rob,<br><br></div>Have you ever had this issue that when you try to change FederationMetadataUrl it doesn't change even if you change authentication to Managed and then change back with federation parameters. I have changed it to managed to change the logouturl and now when I am trying to federate it with correct parameters in single command it is not changing FederationMetadataUrl. It changes everything but not FederationMetadataUrl.<br>
<br></div>I have manually typed the command and also made sure that $variable holds the correct link to SAML metadata.<br><br></div>Would you please help me? It's broken now which I didn't want to.<br><br></div>Thanks.<br>
</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On 20 August 2014 09:01, Farzan Qureshi <span dir="ltr"><<a href="mailto:fqureshi@rosmini.school.nz" target="_blank">fqureshi@rosmini.school.nz</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div dir="ltr"><div>Bugga!! :( That's not good :( I don't want to break anything.<br>
</div>Any how shall I set LogOffUri to <a href="https://idp.rosmini.school.nz/idp/logout.jsp" target="_blank">https://idp.rosmini.school.nz/idp/logout.jsp</a> <br>
?<br></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On 20 August 2014 08:57, Rob Gorrell <span dir="ltr"><<a href="mailto:rwgorrel@uncg.edu" target="_blank">rwgorrel@uncg.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid">
<p dir="ltr">This is what I was saying in the other thread... it doesn't like incremental changes here. You need to set your domain back to managed and then toggle it back to saml federated with all the params correctly set at once through this cmdlet</p>
<span><font color="#888888">
<p dir="ltr">Rob</p></font></span><div><div>
<div class="gmail_quote">On Aug 19, 2014 4:53 PM, "Farzan Qureshi" <<a href="mailto:fqureshi@rosmini.school.nz" target="_blank">fqureshi@rosmini.school.nz</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid">
<div dir="ltr"><div><div>Hi Rob,<br><br></div>This is what I am doing:<br><br>Set-MsolDomainAuthentication -DomainName $dom -Authentication Federated -LogOffUri $logouturl<br><br></div>But when I get properties it shows:<br>
<div><br>PassiveClientSignOutUrl : <a href="https://idp.rosmini.school.nz/logout" target="_blank">https://idp.rosmini.school.nz/logout</a><br><br><br></div><div>It is not changing it.<br></div></div><div class="gmail_extra">
<br><br>
<div class="gmail_quote">On 20 August 2014 08:49, Farzan Qureshi <span dir="ltr"><<a href="mailto:fqureshi@rosmini.school.nz" target="_blank">fqureshi@rosmini.school.nz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid">
<div dir="ltr">Shall I set LogOffUri to <a href="https://idp.rosmini.school.nz/idp/logout.jsp" target="_blank">https://idp.rosmini.school.nz/idp/logout.jsp</a>?<br></div><div><div><div class="gmail_extra">
<br><br><div class="gmail_quote">On 20 August 2014 08:49, Farzan Qureshi <span dir="ltr"><<a href="mailto:fqureshi@rosmini.school.nz" target="_blank">fqureshi@rosmini.school.nz</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div dir="ltr">Ok please wait let me check.<br></div><div>
<div><div class="gmail_extra"><br><br>
<div class="gmail_quote">On 20 August 2014 08:46, Rob Gorrell <span dir="ltr"><<a href="mailto:rwgorrel@uncg.edu" target="_blank">rwgorrel@uncg.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div dir="ltr"><div>I get a powershell error, because that cmdlet only works for an ADFS federated domain, not an SAMLP one.<br>
</div><div>For SAML, you need to use the LogOffUri parameter from Set-MsolDomainAuthentication cmdlet...<span><font color="#888888"><br>
<br></font></span></div><span><font color="#888888">-Rob<br></font></span></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Aug 19, 2014 at 4:42 PM, Farzan Qureshi <span dir="ltr"><<a href="mailto:fqureshi@rosmini.school.nz" target="_blank">fqureshi@rosmini.school.nz</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div dir="ltr"><div><div>Thanks Nate and Rob.<br><br></div>
Rob, when you run this command on your server to get properties:<br>
Get-MsolFederationProperty -DomainName <a href="http://UNCG.EDU" target="_blank">UNCG.EDU</a><br><br></div>What you get against PassiveClientSignOutUrl?<br>
<br></div><div><div><div class="gmail_extra"><br><br><div class="gmail_quote">On 20 August 2014 02:44, Rob Gorrell <span dir="ltr"><<a href="mailto:rwgorrel@uncg.edu" target="_blank">rwgorrel@uncg.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid">
<div dir="ltr"><div>per Nate's link, you will need to configure and point this URL to your logout.jsp template. <br>For me, the URL looks like: <a href="https://idp.uncg.edu/idp/logout.jsp" target="_blank">https://idp.uncg.edu/idp/logout.jsp</a><br>
<br></div>-Rob<br><br></div><div class="gmail_extra"><br><br><div class="gmail_quote"><div><div>On Mon, Aug 18, 2014 at 11:40 PM, Farzan Qureshi <span dir="ltr"><<a href="mailto:fqureshi@rosmini.school.nz" target="_blank">fqureshi@rosmini.school.nz</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div><div><div dir="ltr"><div><div>Hi,<br><br>
</div>I have defined logout URL in Office 365 as<br>
<br><br>PassiveClientSignOutUrl : <a href="https://idp.rosmini.school.nz/logout" target="_blank">https://idp.rosmini.school.nz/logout</a><br>
<br>
</div><br><br>But I get following error when a user logs out, we get:<br><br><h1>Not Found</h1>
<p>The requested URL /logout was not found on this server.</p><p><br></p><p>And this is what I have in address bar:<br></p><div><br><br><br><a href="https://idp.rosmini.school.nz/logout?SAMLRequest=nZHLasMwEEV/xWgvP2InsURscAkBQx7QNKVkUxRFbkRtydWMofTra7tetJtSupyZO/fOkVYgmppv7Yvt8F69dQrQe29qA3wYZKRzhlsBGrgRjQKOkh%2BL3ZbP/JC3zqKVtibeul/TRqC2JiM3xBZ4EOhr6zsLjTbaB3mztvbNR1CPUcQr1xl5TpcXlqRyQdlyIWgiLgm9sIjRSIm5YnMZL6Uk3qNyMDr3of0iQKdKAygM9q0wSmiY0og9hDGPZzyJz8TLVyPWKHV/5hEAyg0MJB9klboqNzLxnZY9ia3wYGpt1Cr4Zj9l7Xu7cv2PLG9jXSPwd/nQ0VdajVLeDg8CqAySvMTF3W3ztD%2B/Ho6b9HQ8bVXBiiybbvw6K5%2BqH/%2BcfwIOPK35&RelayState=A5gGBk4RnOLcU156TZ*rehh95QXq&SigAlg=http://www.w3.org/2000/09/xmldsig%23rsa-sha1&Signature=lKOQ/zwElEh01I1liHa5woG27K%2B/UrlFYsF/Gt5VHMoyaDhpvEQ5%2BXLjkuA31F4AdD%2B5eELvAMe8%0D%0APNQaMi3Jocn5f00CRjTMX%2BeOVNYr/aXhS5FaTv1OyEJ0AbJkpb/mTXHmmotDcQUc%2ByHCA65YYqut%0D%0A3HT0mP1T6222tmqszbsAZClaZjvuOwBN1eFxdve7d7Iw1frKlrJqIHuVkTN%2BPomHzUyJrZu5nYOy%0D%0Ay%2B/xxM%2B70VBfy2NRWTqL1PEBLr7NH%2B/4bdl%2BIwANf4dG2xXg3msBpqiyegFuJxvxOgEkgFlGuTfV%0D%0AWy5Kxal1AkD5wVJCx4LN9Rfah5GsYC7AyH3AKQ%3D%3D" target="_blank">https://idp.rosmini.school.nz/logout?SAMLRequest=nZHLasMwEEV/xWgvP2InsURscAkBQx7QNKVkUxRFbkRtydWMofTra7tetJtSupyZO/fOkVYgmppv7Yvt8F69dQrQe29qA3wYZKRzhlsBGrgRjQKOkh%2BL3ZbP/JC3zqKVtibeul/TRqC2JiM3xBZ4EOhr6zsLjTbaB3mztvbNR1CPUcQr1xl5TpcXlqRyQdlyIWgiLgm9sIjRSIm5YnMZL6Uk3qNyMDr3of0iQKdKAygM9q0wSmiY0og9hDGPZzyJz8TLVyPWKHV/5hEAyg0MJB9klboqNzLxnZY9ia3wYGpt1Cr4Zj9l7Xu7cv2PLG9jXSPwd/nQ0VdajVLeDg8CqAySvMTF3W3ztD%2B/Ho6b9HQ8bVXBiiybbvw6K5%2BqH/%2BcfwIOPK35&RelayState=A5gGBk4RnOLcU156TZ*rehh95QXq&SigAlg=http://www.w3.org/2000/09/xmldsig%23rsa-sha1&Signature=lKOQ/zwElEh01I1liHa5woG27K%2B/UrlFYsF/Gt5VHMoyaDhpvEQ5%2BXLjkuA31F4AdD%2B5eELvAMe8%0D%0APNQaMi3Jocn5f00CRjTMX%2BeOVNYr/aXhS5FaTv1OyEJ0AbJkpb/mTXHmmotDcQUc%2ByHCA65YYqut%0D%0A3HT0mP1T6222tmqszbsAZClaZjvuOwBN1eFxdve7d7Iw1frKlrJqIHuVkTN%2BPomHzUyJrZu5nYOy%0D%0Ay%2B/xxM%2B70VBfy2NRWTqL1PEBLr7NH%2B/4bdl%2BIwANf4dG2xXg3msBpqiyegFuJxvxOgEkgFlGuTfV%0D%0AWy5Kxal1AkD5wVJCx4LN9Rfah5GsYC7AyH3AKQ%3D%3D</a><br>
<br><br></div><div>How I can define what happens when a user sign out? What is the correct link to sign out?<span><font color="#888888"><br clear="all"></font></span></div><span><font color="#888888"><div>
<div><div><br>-- <br><font face="tahoma, sans-serif"><b>Farzan Qureshi</b> | Network Administrator & Help-desk Support | Rosmini College | (09) 487 0 530</font>
</div></div></div></font></span></div></div></div><span><font color="#888888">
<br><div>
<font size="1" style="font-family:Verdana">This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager (<span style="font-style:italic;font-weight:bold"><a href="mailto:admin@rosmini.school.nz" target="_blank">admin@rosmini.school.nz</a></span>). Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. <span style="font-weight:bold">Rosmini College</span> accepts no liability for any damage caused by any virus transmitted by this email.</font></div>
</font></span><div><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></div></blockquote></div><span><font color="#888888"><br>
<br clear="all"><br>-- <br><div dir="ltr"><div>Robert W. Gorrell<br>
Systems Architect, Identity and Access Management </div>
<div>University of NC at Greensboro<br><span style="white-space:nowrap"><a href="tel:336-334-5954" target="_blank" value="+13363345954">336-334-5954</a></span><br>PGP Key ID B36DB0CA<br></div></div>
</font></span></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><br>-- <br><font face="tahoma, sans-serif"><b>Farzan Qureshi</b> | Network Administrator & Help-desk Support | Rosmini College | (09) 487 0 530</font>
</div>
<br>
<font size="1" style="font-family:Verdana">This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager (<span style="font-style:italic;font-weight:bold"><a href="mailto:admin@rosmini.school.nz" target="_blank">admin@rosmini.school.nz</a></span>). Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. <span style="font-weight:bold">Rosmini College</span> accepts no liability for any damage caused by any virus transmitted by this email.</font></div>
</div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><br>-- <br><div dir="ltr"><div>
Robert W. Gorrell<br>
Systems Architect, Identity and Access Management </div>
<div>University of NC at Greensboro<br><span style="white-space:nowrap"><a href="tel:336-334-5954" target="_blank" value="+13363345954">336-334-5954</a></span><br>PGP Key ID B36DB0CA<br></div></div>
</div>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><br>-- <br><font face="tahoma, sans-serif"><b>Farzan Qureshi</b> | Network Administrator & Help-desk Support | Rosmini College | (09) 487 0 530</font>
</div>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><font face="tahoma, sans-serif"><b>Farzan Qureshi</b> | Network Administrator & Help-desk Support | Rosmini College | (09) 487 0 530</font>
</div>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><font face="tahoma, sans-serif"><b>Farzan Qureshi</b> | Network Administrator & Help-desk Support | Rosmini College | (09) 487 0 530</font>
</div>
<br>
<font size="1" style="font-family:Verdana">This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager (<span style="font-style:italic;font-weight:bold"><a href="mailto:admin@rosmini.school.nz" target="_blank">admin@rosmini.school.nz</a></span>). Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. <span style="font-weight:bold">Rosmini College</span> accepts no liability for any damage caused by any virus transmitted by this email.</font><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><br>-- <br><font face="tahoma, sans-serif"><b>Farzan Qureshi</b> | Network Administrator & Help-desk Support | Rosmini College | (09) 487 0 530</font>
</div>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><font face="tahoma, sans-serif"><b>Farzan Qureshi</b> | Network Administrator & Help-desk Support | Rosmini College | (09) 487 0 530</font>
</div>
<br>
<font size="1" style="font-family:Verdana">This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager (<span style="font-style:italic;font-weight:bold"><a href="mailto:admin@rosmini.school.nz" target="_blank">admin@rosmini.school.nz</a></span>). Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. <span style="font-weight:bold">Rosmini College</span> accepts no liability for any damage caused by any virus transmitted by this email.</font></div>
</div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><br>-- <br><div dir="ltr"><div>Robert W. Gorrell<br>
Systems Architect, Identity and Access Management </div>
<div>University of NC at Greensboro<br><span style="white-space:nowrap">336-334-5954</span><br>PGP Key ID B36DB0CA<br></div></div>
</div>