<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Thanks Mathew, <BR><BR>Where exactly it states that "Office365's implemention of ECP will take the "local <BR>part" of the O365 UPN " you mean firstname.lastname considering below? <BR><BR>in our case the UPN is firstname.lastname@ourfederationtest.com.test.au <BR>How about yours? <BR><BR>The reason I felt email is the only option as the username because, even if you try to create a outlook mail profile on your desktop, first thing it prompt is email address. <BR><BR>Our Web SSO (shibboleth + Office 365) works fine, just that for ECP, we want to figure it out the best way of testing, <BR><BR>How did you really test the ECP/Shibboleth with Office 365? Which non-web client you used? iPhone etc? <BR><BR><BR><BR>Also regarding Office 365 Web initiative, I still dont see any official announcements even thought there are many iPhone appls geared with Web SSO. <BR><BR>Still I believe ECP should be on considering other needs which have not been ruled out yet.<BR><BR>Thanks <BR><BR><BR> <BR>
<DIV>> Date: Mon, 3 Aug 2015 08:43:49 +0100<BR>> From: m.slowe@kent.ac.uk<BR>> To: users@shibboleth.net<BR>> Subject: Re: Non-web Clients<BR>> <BR>> On Thu, Jul 30, 2015 at 05:18:30AM +0000, lalith jayaweera wrote:<BR>> > When setting up Shibboleth with Basic Http authentication for ECP, to<BR>> > check Office365, is it correct to state login 'username' will be email.<BR>> > Hence in the apache block for the ECP, the AuthLDAPURL will be something<BR>> > like below.<BR>> > <BR>> > AuthLDAPURL [1]ldap://ldap.example.org/ou=People,dc=example,dc=org?mail<BR>> > <BR>> > because Looking at lot of non-web thick clients, e.g. Office365 clients,<BR>> > outlook profiles, etc.<BR>> > <BR>> > they all start with email address as the username during the set up<BR>> > progress, because I did not get any hit to the IdP server at all.<BR>> <BR>> In my experience, Office365's implemention of ECP will take the "local<BR>> part" of the O365 UPN to use as the username in the Basic Auth part of<BR>> the ECP call (test@example.com -> "test").<BR>> <BR>> > Issue is our current Web SSO is, the username is 'UID' (staffId) not email<BR>> > address. Is it possible to facilitate both?<BR>> <BR>> We use two different ports for the two authentication types -- the<BR>> interactive "Web" traffic uses 443 and does an internal SSO type logon<BR>> for seamless access to O365 while the ECP traffic uses 8443 and uses an<BR>> LDAP config as you have mentioned. See "ActiveLogon" and "PassiveLogon"<BR>> URIs in the Set-MSOLDomainFederationSettings cmdlet[*].<BR>> <BR>> I don't think you can have an AuthLDAPURL which allows you to match one<BR>> username against two different attributes.<BR>> <BR>> [*] https://msdn.microsoft.com/en-us/library/azure/dn194088.aspx<BR>> <BR>> -- <BR>> Matthew Slowe | Server Infrastructure Officer<BR>> IT Infrastructure, Information Services, University of Kent<BR>> Room S21, Cornwallis South<BR>> Canterbury, Kent, CT2 7NZ, UK<BR>> Tel: +44 (0)1227 824265 <BR>> <BR>> www.kent.ac.uk/is | @UnikentUnseenIT | @UKCLibraryIt<BR>> PGP: https://keybase.io/fooflington<BR>> -- <BR>> To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<BR></DIV> </div></body>
</html>