<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
We are integrating with our first ECP SP (Office 365) and need some
help troubleshooting the IDP side of things.<br>
I know this is not an O365 forum, so I will try to keep my questions
to the IDP side of things, but I will accept hints on the O365
configuration as well.<br>
Our web based O365 SAML authentication (non-ECP) is working without
issues.<br>
<br>
Following is a walk through of what we have done to test, what the
IDP logs are showing, our interpretation of the meaning, and some
questions at the end.<br>
<br>
We have IDP 2.4.2 running on Tomcat and think we have basic
authentication configured correctly.<br>
Using a browser, we visit our ECP profile URL (
<a class="moz-txt-link-freetext" href="https://idp-dev.calpoly.edu/idp/profile/SAML2/SOAP/ECP">https://idp-dev.calpoly.edu/idp/profile/SAML2/SOAP/ECP</a> ).<br>
The initial log entry shows the 401 not authorized status that makes
the browser prompt for username and password.<br>
<blockquote>129.65.184.78 - - [26/Nov/2014:06:32:51 -0800] "GET
/idp/profile/SAML2/SOAP/ECP HTTP/1.1" 401 951
<a class="moz-txt-link-freetext" href="https://idp-dev.calpoly.edu/idp/profile/SAML2/SOAP/ECP">https://idp-dev.calpoly.edu/idp/profile/SAML2/SOAP/ECP</a><br>
</blockquote>
The logs then show a successful authentication by showing the
username and a 500 not found status. We assume the 500 status is
because the browser submits a GET request and the profile is
expecting a SOAP/ECP POST request.<br>
<blockquote>129.65.184.78 - <a class="moz-txt-link-abbreviated" href="mailto:omdemo05@calpoly.edu">omdemo05@calpoly.edu</a>
[26/Nov/2014:06:33:10 -0800] "GET /idp/profile/SAML2/SOAP/ECP
HTTP/1.1" 500 255
<a class="moz-txt-link-freetext" href="https://idp-dev.calpoly.edu/idp/profile/SAML2/SOAP/ECP">https://idp-dev.calpoly.edu/idp/profile/SAML2/SOAP/ECP</a><br>
</blockquote>
<br>
With the assumption our ECP authentication is working correctly, we
added the parameter to the O365 configuration to enable ECP: <br>
<blockquote>-ActiveLogOnUri <a class="moz-txt-link-freetext"
href="https://idp-dev.calpoly.edu/idp/profile/SAML2/SOAP/ECP">https://idp-dev.calpoly.edu/idp/profile/SAML2/SOAP/ECP</a>
<br>
</blockquote>
After adding this parameter, the web based authentication continues
to work consistently and we do notice a difference in behavior with
the non-web clients. <br>
When attempting to open a document with the desktop version of MS
Word, we see the same 401 not authorized as above, also showing the
request is coming from WINWORD.EXE.<br>
<blockquote>129.65.184.78 - - [26/Nov/2014:06:03:29 -0800] "POST
/idp/profile/SAML2/SOAP/ECP HTTP/1.0" 401 951 "-" "Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 6.1; WOW64; SLCC2; .NET CLR
2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC
6.0; .NET4.0C; .NET4.0E; InfoPath.3; MSOIDCRL 7.250.4556.0; App
WINWORD.EXE, 15.0.4667.0, {9317BCB6-314B-442F-A5DA-9BC2BEBC271D})"<br>
</blockquote>
Word prompts for username and password and then shows a non-helpful
failure message, yet there are no further IDP logs.<br>
We did find it odd that the ECP request was coming from the desktop
IP address. Based on our understanding, and the diagram found here (
<a class="moz-txt-link-freetext" href="http://blogs.kent.ac.uk/unseenit/author/ms1/">http://blogs.kent.ac.uk/unseenit/author/ms1/</a> ), we assumed the ECP
request would come from somewhere in the O365 cloud.<br>
<br>
Questions/requests:<br>
1. Can someone share their logs to show what a successful ECP authentication
looks like.<br>
2. Should the ECP authentication request come from the users desktop
or from the O365 cloud?<br>
3. Is there a testshib.org like service for testing ECP?<br>
<br>
Thanks,<br>
Dan<br>
<pre class="moz-signature" cols="999">--
Dan Malone
<a class="moz-txt-link-abbreviated" href="mailto:dmalone@calpoly.edu">dmalone@calpoly.edu</a>
Cal Poly State University - San Luis Obispo
</pre>
</body>
</html>